I 


EUROPE 




Internet-facilitated drugs trade 

An analysis of the size, scope and 
the role of the Netherlands 


Kristy Kruithof, Judith Aldridge, David Décary-Hétu, 
Megan Sim, Elma Dujso, Stijn Hoorens 





EUROPE 


Internet-facilitated drugs 
trade 

An analysis of the size, scope and the role of 
the Netherlands 


Kristy Kruithof, Judith Aldridge, David Décary Hétu, 
Megan Sim, Elma Dujso, Stijn Hoorens 


Prepared for the Ministry of Security and Justice, Research and Documentation Centre (WODC) 


For more information on this publication, visi: www.rand.org/t/RR1607 


Published by the RAND Corporation, Santa Monica, Calif., and Cambridge, UK 


RAND* is a registered trademark. 


© 2016 WODC, Ministerie van Veiligheid en Justitie 
Cover image shared by Jo Naylor via Flickr; CC BY 2.0. 


RAND Europe is an independent, not-for-profit policy research organisation that aims to improve policy and 
decisionmaking in the public interest through research and analysis. RAND’s publications do not necessarily reflect 
the opinions of its research clients and sponsors. 


AU rights reserved. No part of this book may be reproduced in any form by any electronic or mechanical means 
(including photocopying, recording, or information storage and retrieval) without permission in writing from the 
sponsor. 


Support RAND 

Make a tax-deductible charitable contribution at 
www.rand.org/giving/contribute 


www.rand.org 

www.rand.org/randeurope 


Preface 


The potential role of the Internet in facilitating drugs trade first gained mass attention with the rise and 
fall of Silk Road; the first major online market place for illegal goods on the dark web. After Silk Road was 
taken down by the FBI in October 2013, it was only a matter of weeks before copycats filled the void. 
Today, there are around 50 so-called cryptomarkets and vendor shops where vendors and buyers find each 
other anonymously to trade illegal drugs, new psychoactive substances, prescription drugs and other goods 
and services. But it is not just the obscure parts of the Internet where drugs are on offer. There are 
numerous web shops, easily found by search engines, which offer designer drugs labelled as ‘research 
Chemicals’. The Netherlands occupies a crucial position in European illicit drug markets. Data from the 
European Monitoring Centre for Drugs and Drug Addiction (EMCDDA 2016a) suggested it is the main 
producer of MDMA, ecstasy and herbal cannabis and a key distribution hub for cannabis resin and 
cocaine. Whether the pivotal role of the Netherlands also extents online, has yet been unclear. While there 
is considerable attention for these new trends in drug markets, the evidence on their size, shape and 
evolvement is fairly limited. 

The Netherlands Ministry of Security and Justice has commissioned, through the Research and 
Documentation Centre (Wetenschappelijk Onderzoek- en Documentatiecentrum, WODC), RAND Europe 
a study to provide a firmer evidence base to this phenomenon and, in particular, the role of the 
Netherlands. In this document, we analyse the size and scope of Internet-facilitated drugs trade both on 
the so-called clear and dark web, paying special attention to the Netherlands, and delineate potential 
avenues for law enforcement for detection and intervention. To this end, RAND Europe has collaborated 
with Judith Aldridge (University of Manchester) and David Décary-EIétu (University of Montreal). The 
views expressed in this document are those of the authors alone and do not represent those of the Ministry 
of Security and Justice. The authors are fully responsible for any errors that may have occurred. 

RAND Europe is an independent not-for-profit policy research organisation that aims to improve policy 
and decision-making in the public interest through research and analysis. This report has been peer- 
reviewed in accordance with RAND’s quality assurance standards. For more information about RAND 
Europe or this document, please contact Stijn Floorens (hoorens@rand.org). 
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Samenvatting 


Het internet heeft over de afgelopen decennia een aanzienlijke impact gehad op een aantal sectoren in de 
economie. E-commerce heeft de efficiëntie van productieketens verbeterd, de toegang tot internationale 
markten vereenvoudigd en de transparantie voor consumenten verbeterd. Dat het internet ook een rol kan 
spelen bij het faciliteren van drugshandel werd voor het eerst echt duidelijk door het succes van Silk Road: 
de eerste grote online illegale marktplaats op het zogenaamde dark web. Silk Road werd door de FBI 
neergehaald in oktober 2013, maar andere, zeer vergelijkbare, markten vulden die ruimte alweer binnen 
enkele weken. 

Vandaag de dag zijn er ongeveer 50 zogenoemde cryptomarkten en webshops die alleen toegankelijk zijn 
met behulp van encryptiesoftware. We gebruiken de term ‘cryptomarkten’, maar er wordt ook wel 
verwezen naar ‘dark net markten’ (DNMs). Cryptomarkten lijken qua uiterlijk veel op online 
markplaatsen, zoals Marktplaats.nl of eBay, ook omdat het mogelijk is voor gebruikers om naar 
advertenties te zoeken en deze vergelijken en om verkopers te beoordelen met feedback. 

Cryptomarkten brengen verkopers en kopers samen, zodat ze onder pseudoniem illegale drugs, nieuwe 
psychoactieve stoffen (NPS), medicijnen en andere, vaak illegale goederen en diensten kunnen 
verhandelen. Het zijn echter niet alleen de donkere krochten van het internet waar drugs worden 
aangeboden. Er zijn talloze webwinkels op het open internet (het zogenoemde clear net) die gemakkelijk te 
vinden zijn met zoekmachines en die voornamelijk NPS, ook wel bekend als designer drugs, aanbieden die 
(nog) niet officieel zijn verboden. 

Buiten het internet, heeft Nederland een centrale positie in Europese illegale drugsmarkten. Volgens het 
Europese Monitoring Centrum voor Drugs en Drugverslaving (EMCDDA) is Nederland de belangrijkste 
producent van xtc en cannabis en een belangrijke doorvoerhaven voor de distributie van hasj en cocaïne. 
Of die cruciale rol voor Nederland zich ook uitstrekt tot het handel via het internet is nog onduidelijk. Er 
is voldoende media-aandacht voor internet-gefaciliteerde drugshandel, maar harde cijfers over de omvang, 
aard en ontwikkeling zijn er nauwelijks. 


Doelstelling en methodes 

De studie beoogt de omvang en het bereik van de drugshandel gefaciliteerd door het internet te 
onderzoeken (Sectie 1.1) 

Dit rapport beoogt de rol van het internet bij het faciliteren van drugshandel te onderzoeken. Het is 
opgesteld in opdracht van het Wetenschappelijk Onderzoek- en Documentatiecentrum (WODC), het 
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onafhankelijke onderzoekscentrum van het Ministerie van Veiligheid en Justitie. Speciale aandacht gaat 
hierbij uit naar de rol van Nederlandse actoren in het faciliteren van deze handel. 

De algemene doelstellingen van dit onderzoek waren: 

• Het inschatten van de omvang en karakteriseren van de aard van drugshandel die door het 
internet wordt gefaciliteerd; 

• Het vaststellen van de rol van Nederland in de drugshandel die door het internet wordt 
gefaciliteerd; en 

• Het verkennen van de mogelijkheden voor de opsporing en interventie door rechtshandhaving. 

De aandacht ging hierbij zowel uit naar drugshandel via cryptomarkten als drugshandel via het clear net. 
Hieronder wordt toegelicht dat de nadruk van de kwantitatieve analyse zal liggen op cryptomarkten. 

We gebruiken een mix van kwalitatieve en kwantitatieve methoden (Hoofdstuk 2) 

Om deze doelstellingen te bereiken zijn verscheidene kwantitatieve en kwalitatieve onderzoeksmethoden 
toegepast: een literatuuronderzoek, interviews met experts en vertegenwoordigers van rechtshandhaving; 
verzameling en analyse van cryptomarketgegevens; en een onderzoek van politiedossiers. 

De nadruk van dit onderzoek lag op drugshandel via cryptomarkten. De kwantitatieve analyse van de 
omvang van dit fenomeen werd uitgevoerd door het scrapen en analyseren van gegevens van acht van de 
grootste cryptomarkten. Deze methoden indexeren alle pagina’s op een webdomein en halen daar de 
relevante informatie uit. Ironisch genoeg is het eenvoudiger om informatie te verkrijgen via web scraping- 
methoden op cryptomarkten, dan op het clear net. Ten eerste, het aantal beschikbare cryptomarkten is 
veel kleiner dan het aantal NPS webwinkels. Ten tweede, clear «ft gegevens bevatten enkel informatie over 
de beschikbare producten en hun prijzen, maar niet over het aantal gemaakte transacties. Op 
cryptomarkten kan het aantal gegeven feedbacks worden gebruikt als proxy voor het aantal transacties. 

De kwantitatieve bevindingen zijn aangevuld en vergeleken met de bevindingen uit de literatuur, 
interviews met experts en vertegenwoordigers van rechtshandhaving en een focusgroep met 
vertegenwoordigers van rechtshandhaving. Verkoop van NPS via webshops op het clear net is 
voornamelijk in kaart gebracht met behulp van literatuuronderzoek en interviews. Waar mogelijk, zijn 
resultaten geïllustreerd met bevindingen uit de analyse van de Nederlandse politiedossiers over een 
neergehaalde cryptomarkt. 


De aard en omvang van drugshandel die gefaciliteerd wordt door het 
internet 

Het aantal NPS webshops is de afgelopen jaren sterk gegroeid, maar de omvang van de markt voor 
NPS op het clear net is onduidelijk (Secties 4.2.2 en 5.1.4) 

In vergelijking met de handel via cryptomarkten hebben we weinig informatie over de omvang van 
drugshandel via het clear net verkregen. De onderzoeksliteratuur hierover is relatief beperkt (ondanks dat 
deze webshops langer bestaan dan cryptomarkten). Desondanks concluderen wij uit onze analyse dat de 
beschikbaarheid van NPS via webwinkels op het clear net snel is toegenomen in de afgelopen jaren. Een 
studie uit 2008 telde 60 NPS webshops in de EU, in 2011 werden er 314 geteld en in 2013 wel 651. NPS 
zijn niet strafbaar gesteld in internationale drugsverdragen, maar kunnen wel mogelijk een gevaar vormen 
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voor de volksgezondheid. NPS mogen online verkocht worden, mits webshops expliciet aangeven dat ze 
niet geschikt zijn voor consumptie. Uit eerder onderzoek bleek dat talloze dergelijke designer drugs (veelal 
onder de noemer van ‘research Chemicals ) te koop worden aangeboden, zoals synthetische cannabinoïden, 
opioïden, tryptamines en benzodiazepines. Een precieze inschatting van het aantal gebruikers in 
Nederland dat deze middelen via het Internet aanschaffen, is echter niet mogelijk gebleken. 

Maar, volgens literatuur- en interviewgegevens lijkt de verkoop van NPS via clear net webshops minder 
prominent in Nederland dan in andere Europese landen. De Europese studie I-TREND heeft 19 
Nederlandse webwinkels gevonden, in vergelijking met 207 Britse en 72 Poolse. De omzet van deze 
webshops blijft onduidelijk. 

Het internet heeft geleid tot nieuwe business modellen voor drugshandel (Sectie 4.2) 

Uit ons onderzoek blijkt dat, net als in vele andere legale markten, het internet tot nieuwe business 

modellen voor drugshandel heeft geleid. Met de opkomst en ondergang van Silk Road 1.0 tussen 2011 en 
2013 wonnen cryptomarkten snel aan populariteit. Een maand voordat Silk Road 1.0 werd neergehaald 
door de FBI, schatten onderzoekers de maandelijkse omzet van drugshandel op meer dan $7 mln. 

Sindsdien hebben we cryptomarkten zien verschijnen en weer verdwijnen, vaak na exit scams door de 
eigenaars zelf of door het neerhalen door de politie. Als onderdeel van deze studie hebben we zo’n 50 
actieve cryptomarkten en webshops geïdentificeerd op het dark web. Negentien daarvan hebben elk ten 
minste 400 advertenties. De drie grootste markten, AlphaBay, Nucleus en Dreammarket, bevatten ongeveer 
65 procent van alle advertenties voor alle producten en diensten tezamen. Voor deze studie hebben we 
informatie van acht van de 50 markten gescrapet. Deze acht markten hadden in totaal 105.811 
advertenties (voor zowel drugs als andere producten en diensten), wat neerkomt op ongeveer 80 procent 
van de advertenties op alle 50 cryptomarkten en webshops. 

Maandelijks wordt tussen de 14 tot 25 miljoen dollar aan drugs omgezet op cryptomarkten (Sectie 4.4) 

Uit ons onderzoek blijkt dat van alle advertenties op de acht geanalyseerde cryptomarkten, het in 57 
procent van de advertenties om drugs gaat. Onze resultaten geven aan dat de totale maandelijkse omzet op 
deze markten minimaal $14.2 mln (€12.6 mln) is. Wanneer medicijnen, alcohol en tabak worden 
weggelaten is de omzet $12.0 mln (€10.6 mln). Vanwege de beperkingen in de methode (uitgelegd in 
Sectie 2.3.2), verschaffen deze cijfers een ondergrens voor de schatting van de totale omzet. De maximum 
schatting voor de maandelijkse drugsomzet op alle cryptomarkten komt uit op $25.0 mln (€22.lm), of 
$21. lm (€18.7) zonder medicijnen, alcohol en tabak.. 

Ondanks verschillende interventies en verstoringen door de politie en verschillende exit scams, bestaan 
cryptomarkten nog steeds. Elet dark web vormt niettemin een nichemarkt voor drugs, want 
cryptomarkten vertegenwoordigen slechts een fractie van de totale drugsmarkt. Terwijl de totale waarde 
van de Europese drugsmarkt geschat wordt op ten minste €2 miljard per maand (ten minste €24 mld per 
jaar in 2013), wijzen onze resultaten voor cryptomarkten wereldwijd slechts richting enkele tientallen 
miljoenen dollars. Ook in Nederland lijkt de omzet door Nederlandse drugverkopers op cryptomarkten 
een stuk lager dan de offline omzet. 
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Cannabis, opwekkende middelen en xtc vormen 70 procent de omzet op cryptomarkten die in deze 
studie zijn geanalyseerd (Sectie 4.4) 

Onze bevindingen laten zien dat er enige continuïteit bestaat in de verhouding waarin verschillende typen 
drugs worden verkocht op cryptomarkten (op basis van zowel transacties als omzet) sinds 2013. Cannabis 
levert nog steeds de hoogste omzet op met 31 procent van de totale drugshandel, gevolgd door 
opwekkende middelen (24 procent, waaronder cocaïne en amfetamine), xtc-achtige drugs (16 procent, 
waaronder xtc en MDMA), psychedelica (8 procent) en opioïden (6 procent, inclusief heroïne). Het 
marktaandeel van deze verschillende typen drugs op cryptomarkten is vergelijkbaar met dat in de offline 
wereld, met name voor opwekkende middelen en cannabis. Wat xtc-achtige drugs betreft, lijken deze 
echter veel populairder op cryptomarkten dan op straat, want het totale offline marktaandeel in Europa 
voor xtc is slechts 2 procent. Voor heroïne geldt het omgekeerde. Dit heeft een marktaandeel van 
ongeveer 28 procent in Europa, terwijl uit onze resultaten blijkt dat het marktaandeel van niet- 
voorgeschreven opioïden (voornamelijk heroïne) vrij gering is (6 procent). Samenvattend zijn het met 
name de party drugs of recreatieve middelen (cannabis, xtc, psychedelica) die cryptomarkten domineren. 

Een mogelijke verklaring voor de verschillen tussen de ‘online’ en ‘offline’ markten kan zijn dat dergelijke 
aankopen via cryptomarkten doorgaans enige planning vereisen, hetgeen wellicht minder goed past bij het 
patroon van dagelijks gebruik door bijvoorbeeld heroïneverslaafden. 


Hoe verhoudt dit zich tot de begintijd van cryptomarkten? 

Cryptomarkten zijn behoorlijk, maar niet explosief gegroeid in de afgelopen paar jaar (Sectie 4.8) 

Cryptomarkten hebben zich bestand getoond tegen ingrijpen door politie- en overige 

handhavingsdiensten. Meteen na de ondergang van Silk Road 1.0 in 2013 zagen nieuwe marktplaatsen 
het levenslicht en deze wonnen snel aan marktaandeel. Maar dit onderzoek laat zien dat drugshandel via 
cryptomarket sindsdien niet explosief, maar geleidelijk is toegenomen. In vergelijking met analyse van Silk 
Road data uit september 2013, blijkt dat het markaandeel van de verschillende typen drugs niet wezenlijk 
is veranderd in 2016. De omzet is sindsdien verdubbeld en het totaal aantal transacties is verdrievoudigd. 
Cryptomarkten bevatten 5.5 keer zoveel advertenties voor drugs. 

Nog steeds niet alleen een eBay voor drugs (Sectie 4.5) 

Advertenties voor kleine hoeveelheden, onder de $100, vormen het grootste deel van de transacties op de 
acht geanalyseerde cryptomarkten. Deze transacties dienen hoogstwaarschijnlijk alleen voor persoonlijk 
gebruik. Deze retail -transacties leveren echter slechts 18 procent van de totale omzet. Dit onderzoek toont 
aan dat transacties van groothandelhoeveelheden (boven de $1000) nog steeds belangrijk zijn op 
cryptomarkten. Ze leverden zowel in september 2013 als in januari 2016 bijna een kwart van de totale 
omzet. De veelgebruikte analogie “een eBay voor drugs” is daarom niet helemaal juist, aangezien eBay 
bedoeld is als eCommerce platform voor business-to-consumer (B2C) verkoop. Dit is een belangrijke 
bevinding. Handel op cryptomarkten faciliteert namelijk niet alleen gebruikers toegang tot een breed scala 
aan middelen. Maar, op basis van het aantal transacties van groothandelhoeveelheden kan men 
concluderen dat ook veel drugsdealers zich op cryptomarkten begeven om hun voorraad aan te vullen 
bestemd voor de offline detailhandel. Zodoende kunnen cryptomarkten ook een rol spelen in het 
verspreiden van een breed scala aan middelen naar lokale offline drugsmarkten. 
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Volgens andere studies zijn er ook voor webshops op het clear net indicaties dat NPS online worden 
gekocht in groothandelhoeveelheden, die vervolgens in kleine hoeveelheden worden doorverkocht of 
verspreid als sociale distributie. 

Er hebben zich de afgelopen jaren enkele ontwikkelingen voorgedaan op cryptomarkten (Sectie 3.2) 

Wederzijds vertrouwen tussen verkopers, kopers en beheerders is van cruciaal belang voor het succes van 

cryptomarkten. Maar dit vertrouwen heeft volgens waarnemers door een reeks lekken in de beveiliging 
van markplaatsen, voorbeelden van oplichting ( scams) en verstoringen en ingrijpen door de politie een 
deuk opgelopen. Deze gebeurtenissen hebben hun weerslag gehad op de levensduur van individuele 
cryptomarkten. Desalniettemin heeft dit gereduceerde vertrouwen niet geleid tot een daling van de 
drugshandel via online marktplaatsen. Door nieuwe innovaties en technologische ontwikkelingen blijft de 
online drugshandel zich gestaag uitbreiden. 

Sommige van deze technische innovaties op cryptomarkten zijn gericht op het verminderen van het risico 
van oplichting voor zowel verkopers als kopers. Hoewel het nog niet op grote schaal wordt gebruikt, 
vereist het zogenoemde multi-signature escrow dat twee van de drie partijen een transactie goedkeuren. Dat 
maakt het onmogelijk voor een partij om in zijn eentje met geld te verdwijnen. Verder zijn hier en daar 
gedecentraliseerde markten ontstaan op basis van peer-to-peer systemen. Deze ontwikkeling staat ook nog 
in de kinderschoenen, maar dergelijke markten kunnen het risico van exit scams en mogelijk ingrijpen 
door de politie verminderen, aangezien het onmogelijk zal zijn om het hele systeem neer te halen. Tot 
slot, het risico van exit scams en de angst dat politiediensten markten zullen neerhalen heeft sommige 
verkopers ertoe gedreven hun eigen webshop op te zetten op het dark web. Ook bestaan er aanwijzingen 
dat verkopers hun potentiële klanten benaderen via (versleutelde) email of directe berichten buiten de 
cryptomarkten om. 

Gangbare routes en de rol van Nederland 

Verkopers in Angelsaksische landen of West-Europa leveren de meeste omzet (Sectie 5.1) 

We hebben de routes geanalyseerd van drugs verkocht via cryptomarkten en daarin hebben we in het 
bijzonder naar de rol van Nederland gekeken. Drugsverkopers op cryptomarkten lijken vanuit tientallen 
verschillende landen te opereren. Verkopers geven op hun advertenties aan van waaruit de producten 
worden verstuurd. Deze informatie hebben we als proxy gebruikt voor het thuisland van verkopers. 
Verkopers die aangeven dat ze de drugs vanuit Nederland verzenden, beschouwen we dus als ‘Nederlandse 
verkopers’. Dit leidt mogelijk tot een onderschatting van het aantal Nederlandse verkopers, omdat er 
aanwijzingen zijn dat sommige Nederlandse verkopers hun drugs vanuit het buitenland versturen. 
Schijnbaar gaan verkopers in dit geval de grens over om vanuit Duitsland of België de pakketjes op de 
post te doen. 

Voor zover bekend hebben cryptomarkten zich voornamelijk gemanifesteerd in de Angelsaksische wereld 
en West-Europa. De meeste verkopers geven aan te opereren vanuit de Verenigde Staten (890), gevolgd 
door het Verenigd Koninkrijk (338) en Duitsland (225). Maar gezien hun rol in de productie van met 
name NPS zouden Aziatische landen, zoals India en China, ook vruchtbare voedingsbodems voor deze 
markten kunnen zijn. 
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Verkopers die aangeven dat ze vanuit de Verenigde Staten drugs verzenden, genereren 36 procent van de 
totale drugsomzet op de geanalyseerde cryptomarkten. Vergeleken met bevindingen uit 2013 is het 
marktaandeel van verschillende landen niet veel veranderd, met uitzondering van Australië. Het aandeel 
van Australische verkopers is namelijk in de afgelopen drie jaar flink gestegen. Andere Angelsaksische 
(Canada en het Verenigd Koninkrijk) alsmede West-Europese landen (Nederland, Duitsland, Spanje, 
Frankrijk) leveren ook een substantieel aandeel. Wanneer we verkopers met elkaar vergelijken, is de omzet 
per verkoper het grootst in Australië. Dit is waarschijnlijk te verklaren doordat de prijzen van drugs in 
Australië aanzienlijk hoger liggen dan in de overige landen, hetgeen zich waarschijnlijk vertaalt naar een 
hogere omzet voor verkopers. 

De 'Nederlandse' drugsomzet is verreweg het grootst per hoofd van de bevolking (Sectie 4.4) 

Verkopers die aangeven dat ze vanuit Nederland handelen zijn verantwoordelijk voor 8 procent van de 
totale drugsomzet op de acht geanalyseerde markten. Per hoofd van de bevolking is die omzet 2.4 keer zo 
groot als de omzet uit het Verenigd Koninkrijk en 4.5 keer zo groot als die van de Verenigde Staten. 

Dat is misschien niet verwonderlijk gezien de belangrijke rol van Nederland in de productie en doorvoer 
van drugs in Europa. ‘Nederlandse verkopers’ lijken zich te specialiseren, aangezien driekwart van alle 
inkomsten gegenereerd door twee typen drugs: xtc-achtige drugs (bijna de helft) en opwekkende middelen 
(een kwart). Dit patroon lijkt een weerspiegeling van de rol van Nederland in de productie van deze typen 
drugs. Online verkopers hebben redelijk eenvoudig toegang tot deze middelen en het is bovendien 
winstgevend vanwege de korte afstand tot productie. Stoffen zoals MDMA kunnen goedkoop in eigen 
land worden geproduceerd en vervolgens tegen hogere (internationale) prijzen worden doorverkocht. 
Deze specialisatie is zelfs nog duidelijker als men enkel kijkt naar groothandelhoeveelheden. 82 procent 
van alle opbrengsten voor ‘Nederlandse’ advertenties van meer dan $1,000 worden gegenereerd door xtc- 
achtige drugs en opwekkende middelen. 

'Nederlandse verkopers' spelen nauwelijks een rol in verkoop van cannabis op cryptomarkten (Sectie 
4.4) 

Onze resultaten tonen aan dat het aandeel van de ‘Nederlandse verkopers’ in de cannabisverkoop op de 
acht cryptomarkten relatief klein is. In elk geval een stuk kleiner dan kan worden verwacht gezien de 
internationaal prominente rol van Nederland in de wietteelt en in de doorvoer van hasj. Cannabis zorgt 
slechts voor 10 procent van de totale Nederlandse drugsomzet via cryptomarkten. ‘Nederlandse verkopers’ 
verzenden ongeveer 11 kilo per maand, slechts 2 procent van de totale omzet voor cannabis die wij 
hebben vastgesteld op cryptomarkten. 

De meest gangbare routes voor drugs via cryptomarkten zijn intra-continentaal (Sectie 5.2) 

Onze resultaten tonen dat de Verenigde Staten en Oceanië (Australië en Nieuw Zeeland) de twee meest 

populaire bestemmingen zijn voor drugs op cryptomarkten. Dat wil zeggen, het verkopers zijn graag 
bereid om drugs daar naartoe te verzenden. Europa komt op de derde plaats met ongeveer $800.000 in 
omzet van drugs. Het was echter een uitdaging voor deze studie om de populaire routes goed in kaart te 
brengen. Meer dan de helft van alle drugsomzet heeft een onbekende bestemming. De meest gangbare 
routes voor drugs zijn die binnen de Verenigde Staten, binnen Europa en binnen Oceanië. Het aandeel 
van verschillende landen in de drugsroutes valt moeilijk nauwkeurig in te schatten. 
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Er is weinig informatie over de vraagkant van online gekochte drugs (Sectie 5.2) 

Met betrekking tot de vraagkant van online gekochte drugs in Nederland bevat de literatuur weinig 
informatie. Er zijn slechts enkele studies naar de herkomst van geconsumeerde drugs en die leveren weinig 
tot geen bewijs over de aanschaf van drugs via internet door Nederlandse consumenten. De verzamelde 
data voor deze studie hebben evenmin veel nieuwe inzichten opgeleverd. De gescrapete 
cryptomarktgegevens bevatten geen informatie over de locatie van kopers, enkel over de landen of 
continenten waarnaar verkopers bereid zijn hun producten te verzenden. Er waren nauwelijks advertenties 
door ‘Nederlandse verkopers’ die enkel binnen Nederland wilden verzenden. Inlichtingen van de 
handhavingsdiensten lijken te bevestigen dat Nederlandse online drugsverkopers voornamelijk aan klanten 
in het buitenland leveren. Nederlandse cryptomarktconsumenten daarentegen lijken volgens deze 
inlichtingen voornamelijk drugs uit eigen land kopen. 

Er worden ook andere drug-gerelateerde producten en diensten aangeboden, maar de omzet daarvan 
is relatief laag (Sectie 4.7) 

Cryptomarkten worden gedomineerd door drugs. Er zijn ook advertenties voor andere producten en 
diensten, bijvoorbeeld die ter ondersteuning van de productie, levering of gebruik van drugs kunnen 
dienen. Hierbij kan gedacht worden aan vervalste identiteitsbewijzen, financiële producten en diensten, of 
apparatuur voor productie. Maar ze brengen relatief weinig geld op. De totale omzet van deze drugs¬ 
gerelateerde producten en diensten in januari 2016 was ongeveer 0.2 procent van de totale drugsverkoop. 
Slechts één op de drie verkopers bood andere producten aan dan drugs en over het algemeen verkochten 
ze niet ook drugs daarnaast. Nederlandse verkopers op cryptomarkten, daarentegen, verkopen vrijwel 
altijd drugs. 


Actoren en hun modus operandi 

De belangrijkste actoren zijn administrators, moderators, ontwikkelaars, verkopers en kopers (Sectie 

6 . 1 ) 

Naast het inschatten van de omvang van cryptomarkten geeft dit rapport ook een karakterisering van de 
verschillende actoren die betrokken zijn bij deze markten. Er zijn verschillende actoren die (bewust of 
onbewust) betrokken zijn bij internet-gefaciliteerde drugshandel. Op cryptomarkten zijn de volgende 
actoren te onderscheiden: administrators (uitvoerend management en penningmeester), ontwikkelaars 
(web design en onderhoud), moderators (medewerkers op de markt), verkopers en kopers. Andere actoren 
die een ondersteunende rol kunnen spelen (en zich mogelijk niet bewust zijn van hun betrokkenheid) zijn 
bitcoin wisselaars, Internet Service Providers, leveranciers van legale producten en postdiensten. In dit 
onderzoek zijn twee actoren (verkopers en kopers) verder uitgelicht. Deze analyse is gebaseerd op 
literatuuronderzoek, interviews en gegevens uit de Nederlandse politiedossiers. 

Hoewel gebaseerd op beperkt bewijs is het aannemelijk dat verkopers jonge mannen zijn uit Engels 
sprekende of West-Europese landen (Sectie 6.2) 

Uit beperkt bewijs blijkt dat drugsverkopers op cryptomarkten vaak relatief jonge (onder de 40), 
opgeleide, IT-vaardige en ondernemingsgezinde mannen zijn afkomstig uit Angelsaksische en West- 
Europese landen. Engels is de meest gebruikte taal op cryptomarkten, al communiceren sommige 
verkopers ook in andere talen. Op online drugsmarkten handelen zowel professionele drugsdealers die 
nauwe banden hebben met de productieketen en de online verkoop van drugs als een extra 
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inkomstenbron zien als newbies die tot dusver alleen drugs aan vrienden verkochten. Financiële, libertijnse 
en veiligheidsmotieven liggen ten grondslag aan het besluit om drugs online te verkopen. We hebben geen 
studies gevonden die informatie bieden over de karakteristieken van verkopers die betrokken zijn bij 
drugshandel op het clear net. 

Kopers worden aangetrokken tot cryptomarkten vanwege een gevoel van verhoogde veiligheid, 
verbeterde kwaliteit van en diversiteit aan drugs en gemak en snelheid van bezorging (Sectie 6.3) 

Uit beperkt bewijs blijkt dat kopers op cryptomarkten ook vaak relatief jonge (onder de 40), opgeleide en 
IT-vaardige mannen uit Angelsaksische en (andere) Europese landen zijn. De meerderheid lijkt te bestaan 
uit recreatieve drugsgebruikers - sommige beschouwen zichzelf als ‘psychonauten’ - die eerder drugs 
hebben gebruikt. Kopers lijken verschillende motieven te hebben voor de aanschaf van drugs op online 
marktplaatsen: een gevoel van verhoogde veiligheid ten aanzien van offline aankopen, verbeterde kwaliteit 
van en diversiteit aan drugs, anonimiteit, en het gemak en de snelheid van levering. Uit eerder onderzoek 
blijkt dat kopers tevens de transparantie en volledigheid van productinformatie op cryptomarkten 
waarderen. Kopers hebben de neiging hun aankopen te baseren op prijs, beschikbare tripverslagen, 
productdetails, reputatie van verkopers en feedback van andere kopers. 

Er is momenteel onvoldoende bewijs om definitieve conclusies te trekken over de vraag of de 
aanwezigheid van online drugsmarkten leidt tot nieuwe actoren die voorheen geen drugs offline kochten 
of verkochten. Er is tevens onvoldoende bewijs om definitieve conclusies te trekken over de vraag of 
online drugsmarkten de offline drugsmarkten vervangen. 


Wijzen van opsporing en interventie 

Er zijn vier brede categorieën van opsporing en interventie (Hoofdstuk 7) 

Naast preventie en schadebeperking is rechtshandhaving een van de drie pijlers van het Nederlandse 
drugsbeleid. Anekdotisch bewijs uit de literatuur en interviews geeft aan dat rechtshandhaving een impact 
heeft gehad op het vertrouwen binnen cryptomarkten. Over het algemeen is de omvang van drugshandel 
op deze markten echter gegroeid. Eerder onderzoek toont aan dat het verplaatsen van verkopers en kopers 
naar andere, bestaande cryptomarkten het voornaamste gevolg was van het neerhalen van cryptomarkten. 
Er wordt verondersteld dat de negatieve impact van scams op het vertrouwen binnen deze online markten 
misschien wel groter is dan wat rechtshandhaving zou kunnen bereiken. In een aantal artikelen en 
interviews wordt gewezen op de potentiële voordelen van internet-gefaciliteerde drugshandel in het 
verminderen van schade geassocieerd met drugsmarkten. 

Op basis van gegevens uit de interviews en literatuur hebben wij vier brede categorieën op het gebied van 
opsporing en interventie van internet-gefaciliteerde drugshandel geïdentificeerd: 

1. Traditionele onderzoekstechnieken die toegepast worden op de drugsketen (bijv. observaties, 
undercover operaties); 

2. Elet opsporen en onderscheppen van post (bijv. samenwerking tussen wetshandhavingsinstanties 
en postdiensten); 

3. Online detectie (bijv. big data technieken, het monitoren van online marktplaatsen, het volgen 
van geldstromen); en 

4. Online verstoring (bijv. neerhalen van online marktplaatsen). 
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Internationale samenwerking en coördinatie (en de bijbehorende juridische vraagstukken), capaciteit en 
middelen, en (technische) mogelijkheden kunnen een faciliterende rol spelen bij het implementeren van 
bovenstaande strategieën. 
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Summary 


Over the past two decades, the Internet has had a transformative effect on business models in numerous 
sectors. e-Commerce has improved efficiency of supply chains, facilitated market access and improved 
transparency for consumers. The potential role of the Internet in facilitating illicit drugs trade was First 
highlighted by the success of Silk Road; the first major online market place for illegal goods on the dark 
web. Silk Road was taken down by the FBI in October 2013, but other, very similar markets filled the 
void within weeks. Today, there are purportedly around 50 so-called cryptomarkets and vendor shops that 
can only be accessed by using encryption software to ensure anonymity. We use the term ‘cryptomarkets’, 
but we note that the term ‘dark net markets’ (DNMs) also becomes more established. Cryptomarkets look 
similar to regular online market places, such as eBay or Amazon, by allowing their customers to search 
and compare products and rate vendors. These markets bring vendors and buyers together acting under 
pseudonyms to trade illegal drugs, new psychoactive substances (NPS), prescription drugs and other, 
often illegal, goods and services. 

It is not just the obscure parts of the Internet where drugs are on offer. There are numerous web shops on 
the clear net, easily found by search engines, which offer mostly NPS, also known as designer drugs that 
have not been officially banned (yet). 

The Netherlands occupies a crucial position in European illicit drug markets. Data from the European 
Monitoring Centre for Drugs and Drug Addiction (EMCDDA) suggested it is the main producer of 
ecstasy and herbal cannabis and a key distribution hub for cannabis resin and cocaine. Whether the 
pivotal role of the Netherlands also extends to the drugs trade facilitated by the Internet has yet been 
unclear. While there has been considerable attention paid to the role of the Internet in facilitating drug 
market from media outlets, the evidence on their size, shape and evolvement is fairly limited. 


Objectives and methodologies 

The study aims to investigate the size and scope Internet-facilitated drugs trade (Section 1.1) 

This report aims to investigate the role of the Internet in facilitating drugs trade. It is commissioned by 

the Research and Documentation Centre (Wetenschappelijk Onderzoek- en Documentatiecentrum, WODQ, 
the independent research arm of the Ministry of Security and Justice in the Netherlands. Special attention 
will therefore be paid to the role of Dutch actors in facilitating this trade. 

The overall aims of this study are: 

• To characterise the scope and the size of Internet-facilitated drugs trade; 

• To identify the role of the Netherlands in Internet-facilitated drugs trade; and 
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• To delineate potential avenues for law enforcement for detection and intervendon 
The study considers trade via cryptomarkets as well as drugs trade facilitated by the clear net. 

For reasons explained below, the emphasis of the quantitative analysis is on cryptomarkets. 

We used a mix of qualitative and quantitative methods (Chapter 2) 

In order to address these objectives, a mix-of quantitative and qualitative methods was applied, consisting 
of: a review of the literature; in-depth interviews with experts and law enforcement representatives; 
collection and analysis of cryptomarket data; and a review of police case files. 

The emphasis of this study was on drugs trade via cryptomarkets. The quantitative assessment of the size 
and scope of this phenomenon was conducted through collection and analysis of scraped data from eight 
of the largest cryptomarkets in January 2016. Ironically, it is more straightforward for the researchers to 
obtain data via web scraping/crawling techniques deployed on cryptomarkets than on the clear net. These 
techniques identify all pages on a web domain and extract the relevant information. First, because the 
number of available cryptomarkets is much smaller than that of NPS web shops. And second, because 
scraped data from the clear net teil us only about substances listed for sale there and their prices, and not 
the extent to which sales occur. On cryptomarkets, the number of feedbacks can be used as a proxy for 
transactions. 

The quantitative findings were complemented with and compared to fmdings from the literature, 
interviews with experts and law enforcement officials and a focus group with law enforcement 
representatives. Trade of NPS via clear net market places was primarily investigated through literature 
review and interviews. Where possible, the results were illustrated with fmdings from analysis of Dutch 
police case files relating to Internet-facilitated drugs trade. 


The size and shape of Internet-facilitated drug markets 

On the clear net the size of the online market for NPS is unclear, but the number of web shops has 
grown considerably in recent years (Sections 4.2.2 and 5.1.4) 

We were unable to learn as much about the undoubtedly growing clear net sales of legal substances, 
compared to sales via cryptomarkets. The research literature here is comparatively limited (in spite of the 
fact that these markets have existed for longer than cryptomarkets). Nevertheless, we conclude from our 
analysis that the availability of NPS via web shops on the clear net has increased quickly in recent years. 
Previous studies identified 60 web shops in the EU in 2008, 314 in 2011 and 651 in 2013. NPS are not 
controlled by the international drug conventions, but they may pose a public health threat. They can be 
sold online, provided web shops indicate explicitly that they are not intended for human consumption. 
Previous research found that numerous different types of designer drugs (often labelled as research 
Chemicals) were offered for sale, including synthetic cannabinoids, opioids, tryptamines, and 
benzodiazepines. The size of the buyer population is unclear. 

Based on literature and interview data, sales of NPS via clear net web shops seemed to be less prominent 
in the Netherlands than in other European countries. The EU-funded I-TREND study found 19 shops 
operating from the Netherlands, compared to 207 from the UK and 72 from Poland. These markets are 
generating an unknown amount of revenue. 
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The Internet has created new business models for drugs trade (Section 4.2) 

Overall, we found that - similar to many markets for licit goods - the Internet has created new business 
models for drugs trade. Cryptomarkets quickly gained popularity between 2011 and 2013 with the rise 
and fall of Silk Road 1.0. A month before it was taken down by the FBI, researchers estimated monthly 
revenues for drugs trade on Silk Road 1.0 at more than US$7m. 

Since then, cryptomarkets have appeared and disappeared again, often following exit scams or take downs. 
As part of this study, we identified about 50 live cryptomarkets and single-vendor shops on the hidden 
web. Some 19 of them had at least 400 listings each. The three largest markets, AlphaBay, Nucleus, and 
Dreammarket, accounted for about 65 per cent of all listings across all products and services. Some eight 
of the 50 markets identified were scraped for this study, and these eight sites had 105,811 listings (across 
all products and services), approximately 80 per cent of all listings across all 50 cryptomarkets. 

Monthly revenues from drugs on cryptomarkets are in the double-digit million dollars (Section 4.4) 

Of all products and services on offer, we found that 57 per cent of listings across the scraped 
cryptomarkets offered drugs. Our results indicate the eight cryptomarkets analysed for the study generate 
a total monthly revenue of $l4.2m (€12.6m) and $12.Om (€ 10.6m) when prescription drugs and alcohol 
and tobacco are excluded. These figures represent a lower-boundary estimate, due to some limitations of 
our approach (explained in Section 2.3.2). An upper-boundary estimate for monthly drug revenues via 
visible listings on all cryptomarkets would be $25.Om (€22.lm), or $21.lm (€18.7) without prescription 
drugs, alcohol and tobacco. 

So, despite law enforcement intervention and various exit scams on these marketplaces, cryptomarkets 
have survived. Yet, they represent a niche part of drugs trade at large, as they constitute a fraction of the 
total drug market in the offline world. Whereas the total retail value of the European drug market is 
estimated to amount at least €2bn per month (i.e. at least €24bn annually in 2013), our data suggested 
monthly revenues for international cryptomarkets in double-digit million dollars. Similarly, for the Dutch 
context, revenues for ‘Dutch vendors’ on cryptomarkets appeared to be much lower than offline revenues. 

Cannabis, stimulants and ecstasy are responsible for 70 per cent of all revenues on cryptomarkets 
included in this study (Section 4.4) 

Our findings indicate that the types of drugs sold on cryptomarkets and their relative importance as 
assessed by sales (transactions and revenues) showed continuity since 2013. Cannabis still generated 
highest revenues, 31 per cent of all drugs revenues, followed by stimulants (24 per cent, including cocaine 
and amphetamines), ecstasy-type (16 per cent, including ecstasy and MDMA), psychedelics (8 per cent) 
and opioids (6 per cent, including heroin). These revenue shares seem to mimic the retail value of 
different drug types in the offline world, particularly for stimulants and cannabis. Ecstasy-type drugs, 
however, appeared to be much more popular on cryptomarkets than out on the Street, as it only 
constitutes about 2 per cent of the total European retail value. On the other hand, estimates suggested 
that heroin takes up around 28 per cent of the total European drugs retail market, whereas our results 
suggest that the market share of non-prescription opioids (mostly heroin) remains fairly small (6 per cent). 
In sum, for Online markets there is a predominance of drugs typically associated with recreational or 
‘party’ use (cannabis, ecstasy, psychedelics). 
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A possible explanation for these differences between ‘online’ and ‘offline’ markets may be that 
cryptomarket purchases typically require an element of planning, which may not suit the daily use of 
dependent users of, for instance, heroin. 


How does this compare to the early days of cryptomarkets? 

Cryptomarkets have grown substantially in the past few years, but not explosively (Section 4.8) 

Drugs trade via cryptomarkets has shown to be resilient to law enforcement intervention and distortion, 
as new market places quickly emerged and gained market share. Since the heyday of Silk Road 1.0 in 
2013, however, we conclude that the evolution of drugs trade via cryptomarkets is one of incremental 
change, rather than explosive. Comparing to results from Silk Road data scraped by members of our team 
in September 2013, we found that the distribution of drugs types was very similar in 2016. Revenues have 
about doubled since then, and the total number of transactions has tripled. The number of listings for 
drugs has grown by 5.5 times. 

Still not just an eBay for Drugs (Section 4.5) 

The lion’s share of transactions on cryptomarkets scraped for this study is generated by listings under 
$100, most likely to be for personal use. But these retail transactions generate only 18 % of total revenues. 
We found that large ‘Wholesale’ level transactions (those greater than $1,000) remained important for 
cryptomarkets, generating nearly one quarter of overall revenue both in September 2013 and in January 
2016. The often-used analogy ‘an eBay for drugs’ is not entirely correct, because eBay is intended as an 
online retail market. This is an important finding. Cryptomarket trade may have an impact beyond 
creating a new way for drug users to access a wide range of drugs; based on the extent of Wholesale 
transactions, we believe it is likely that many cryptomarket customers are drug dealers sourcing stock 
intended for offline distribution. Cryptomarkets may therefore be diffusing a wide range of substances 
into local offline drug markets. For clear net markets, there are some indications based on previous studies 
that NPS are purchased in wholesale quantities online for the purpose of retail or social supply. 

Since the early days of Silk Road 1.0, we have observed a number of trends on cryptomarkets (Section 
3.2) 

Trust between vendors, buyers and administrators has been considered important for the success of 
cryptomarkets and their vendors. However, following a series of security failures, scams and law 
enforcement disruptions and interventions, observers reported declining levels of trust between actors. 
These may have impacted on the longevity of individual cryptomarkets. Nevertheless, the environment of 
reduced trust did not appear to have prevented the drugs trade on online marketplaces, and new 
innovations and developments appeared to have arisen, allowing trade to flourish in spite of these 
challenges. 

Some technical innovations implemented on cryptomarkets are aimed at reducing the risks to vendors and 
buyers of scams. For example, although not yet widely adopted, multi-signature escrow requires sign-off 
from two out of three parties, which makes it impossible for one party to single-handedly retrieve funds 
and disappear. Decentralised markets that operate using a peer-to-peer system, while still in their infancy, 
have the potential to reduce the possibilities of law enforcement disruption and intervention, as it will be 
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impossible to take the entire system down. Finally, exit scant risk and fear of law enforcement take down 
have led some vendors to establish single-vendor shops and to encourage potential buyers to approach 
them via (encrypted) email or direct messaging. 


Shipping routes and the role of the Netherlands 

Most revenues are generated by vendors who indicate they are operating from Anglo-Saxon countries 
or Western Europe (Section 5.1) 

We undertook analysis to understand shipping routes via cryptomarkets and the role of the Netherlands 
in particular. Cryptomarket vendors appeared to be shipping from dozens of countries. For this study we 
use vendors who self-report that they are shipping from the Netherlands as a proxy for ‘Dutch vendors’. 
This could be an underestimate, as there are indications that some ‘Dutch vendors’ also offer listings that 
ship from outside the Netherlands. In this case, vendors would drive across a border to ship from 
neighbouring countries like Germany. 

To our knowledge, and that of the literature, cryptomarkets have primarily manifested themselves in the 
Anglo-Saxon world and Western Europe. Most vendors appeared to be operating from the United States 
(890), followed by the United Kingdom (338), and Germany (225). But given their role in production, 
Asian countries (such as China and India) may also be fertile breeding ground for online drug sales. 

Vendors indicating they ship from the United States generate 36 per cent of all drug revenues within our 
sample. Compared to fmdings in 2013, the distribution of revenues across countries has not changed 
much with the exception of Australia, which has seen its share of revenues increase over the past three 
years. Other Anglo-Saxon (Canada and the United Kingdom) as well as Western European countries (the 
Netherlands, Germany, Spain, France) also generate substantial proportions of revenues. When 
comparing per vendor, Australia appeared to generate most revenues per vendor. This is in line with the 
vastly higher prices of drugs in Australia, which probably translates to higher prices per unit. 

Revenues from vendors operating from the Netherlands are by far the largest on a per capita basis 
(Section 4.4) 

Revenues to vendors reporting to operate from the Netherlands accounted for 8 per cent of total drug 
revenues from the eight markets monitored. On a per capita basis, revenues to vendors operating from the 
Netherlands were 2.4 times higher than those from the United Kingdom and 4.5 higher than those from 
the United States. 

This perhaps is not surprising given its important role in production and transit of drugs in Europe. 
Vendors likely to be based in the Netherlands showed clear patterns of specialisation in our analysis, with 
three quarters of all revenue generated in two drug categories: ecstasy-type drugs (accounting for nearly 
half of all revenue for these vendors) and stimulants (another quarter). It likely reflects the Netherlands’ 
role in the production of these drug types, making vendor access to these substances relatively easy and 
also profitable given their location in the supply chain. Substances, such as MDMA, can be produced 
inexpensively domestically and then resold for higher prices in other countries. At the Wholesale level, this 
specialisation became even greater, with ecstasy-type and stimulants accounting for 82 per cent of all 
Wholesale revenue for ‘Dutch vendors’. 
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'Dutch vendors' hardly play a role in Cannabis sales (Section 4.4) 

Contrary to observations made by various interviewees our results suggested that the share of ‘Dutch 
vendors’ in cannabis sales within the eight cryptomarkets is smaller than might be expected, given the 
prominent role of the Netherlands in herbal cannabis production and the transit of cannabis resin. We 
found that only 10 per cent of drugs revenues for ‘Dutch vendors’ was generated by cannabis and ‘Dutch 
vendors’ shift about 11 kilos a month, just 2 per cent of the total volume of cannabis we identified on 
cryptomarkets. 

The most common shipping routes for drugs are intra-continental (Section 5.2) 

We found that the United States and Oceania (Australia and New Zealand) were the two most common 
destinations for vendors who specified where they are willing to ship to. Europe came in third position 
with about $800,000 in drug revenues. However, it should be noted that it was challenging in this study 
to tracé shipping routes, since more than half of all drug revenues have an unknown destination. The 
most common routes for drugs were those within United States, within Europe and within Oceania. Elere 
again, given that incomplete or unknown routes account for more than a third of all drug revenues, it was 
difficult to precisely estimate the share of drug shipping routes. 

There is little evidence on the proportion of drugs consumed that are purchased online (Section 5.2) 

We could find little evidence from previous research and from the new data collected for this study of the 
demand side for Internet-purchased drugs in the Netherlands. Scraped cryptomarket data only contained 
information about the destinations that vendors are willing to ship to. There was no information about 
buyer locations. Almost no listings were posted by ‘Dutch vendors’ that targeted only customers in the 
Netherlands. Intelligence from law enforcement seems to confirm that ‘Dutch vendors’ primarily sold to 
buyers abroad, while Dutch buyers predominantly purchased drugs domestically. 

The limited number of studies that reported on consumers buying drugs online found little to no 
evidence that Dutch customers were using the Internet to buy drugs. 

Products and services that can be used to support drug productions, supply or use are available, but 
revenues are comparatively low (Section 4.7) 

Products and services that might be used to support drug production, supply and use, such as counterfeit 
IDs, financial products and services, or production equipment are also listed on cryptomarkets. They 
generate sales, albeit in negligible amounts in comparison to drugs themselves. We found that the total 
revenue generated by these products and services in January 2016 was about 0.2 per cent of the amount 
generated by drug sales. Only about one in three vendors included in our sample sold non-drug products 
and services, and these vendors did not tend to also sell drugs. Dutch vendors are nearly absent in this 
business. 


Actors and their modus operandi 

The main actors are administrators, moderators, developers, vendors and buyers (Section 6.1) 

In addition to estimating the size of cryptomarkets, this report presents a characterisation of the different 
actors involved in these markets, to feed into the broader understanding of Internet-facilitated drugs 
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trade. There are several actors (knowingly or unknowingly) involved in Internet-facilitated drugs trade, 
with key actors on cryptomarkets ranging from administrators (executive management and treasurer), 
developers (web design and maintenance) and moderators (staff members on the marketplace) to vendors 
and buyers selling and purchasing on these marketplaces respectively. In addition, other actors that play a 
supporting role (and may not be aware of their involvement) include bitcoin exchangers, Internet Service 
Providers, suppliers of legal goods and postal services. Vendors and buyers were analysed in more detail, 
based on literature, interviews and case file data. 

Evidence is limited, but vendors seemed to be young, males from English speaking or Western European 
countries (Section 6.2) 

Based on limited, sometimes anecdotal, evidence from the literature, interviews and case file analysis, it 
was found that vendors selling drugs on cryptomarkets seemed to be relatively young (under the age of 
40), well-educated and entrepreneurial males from Anglo-Saxon countries or Western Europe with strong 
IT-skills. Although English was the dominant language on cryptomarkets, some vendors did 
communicate in other languages. Vendors seemed to be a mix of professional drug dealers with close ties 
to production who consider Internet sales as an additional revenue stream and ‘newbies’ who thus far only 
sold drugs to friends. Financial, libertarian and (perceptions of increased) safety motives underpin the 
decision to sell drugs online. There were no studies identified that provided information on the 
characteristics of vendors involved in clear net drugs trade. 

Buyers are attracted to cryptomarkets because of perceived increased safety, improved quality and 
variety, ease and speed of delivery (Section 6.3) 

Similarly, evidence on the consumer side of Internet-facilitated drugs trade is limited. According to 
previous research and interviewees, buyers on cryptomarkets also seemed to be relatively young, educated 
and tech-sawy males from Anglo-Saxon and (other) European countries. The majority seemed to consist 
of recreational drug users (some considered themselves ‘psychonauts’), who have used drugs previously. 
Buyers seemed to be motivated to buy drugs online due to a perception of increased safety vis-a-vis offline 
purchases, and improved quality and product variety, anonymity and the ease and speed of delivery. 
Previous research found that buyers also appreciated the transparency and comprehensiveness of 
information on products available on cryptomarkets. They tended to base their purchases on price, 
available ‘trip reports’, products details, vendor reputation and feedback from other buyers. 

There is currently insufficiënt evidence to draw firm conclusions on whether the presence of online drug 
markets leads to new actors that previously would not have sold or bought drugs offline, or whether the 
offline market is substituted by online markets. 

Modes of detection and intervention 

There are four broad categories of modes of detection and intervention (Chapter 7) 

Law enforcement is one of three pillars of Dutch drugs policy, alongside prevention and harm reduction. 
Anecdotal evidence from the literature and interviews suggests that law enforcement activities have had an 
impact on confidence in cryptomarkets, but on aggregate, the size of trade has grown nonetheless. 
Previous studies concluded that the main consequence of bringing down marketplaces has been the 
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migration of vendors and customers to other existing cryptomarkets. It has been suggested that the 
negative impact of scams on trust within markets might be greater than what law enforcement action 
could achieve. Also, some authors and interviewees highlighted the potential benefits of Internet- 
facilitated drugs trade to reducing harms associated with drug markets. 

Based on interview and literature data, we identified four broad categories of potential strategies that are 
available to law enforcement in the detection and intervention of Internet-facilitated drugs trade: 

1. Traditional investigation techniques applied in the drug chain (e.g. surveillance, undercover 
operations); 

2. Postal detection and interception (e.g. collaboration between law enforcement agencies and postal 
services); 

3. Online detection (e.g. big data techniques, monitoring of online marketplaces, tracking money 
flows); and 

4. Online disruption (e.g. taking down online marketplaces). 

International cooperation and coordination (and the accompanying legal challenges), capacity and 
resources, and (technical) capabilities could play a facilitating role in deploying the different strategies to 
tackle Internet-facilitated drugs trade. 
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Glossary 


Term 

Explanation/definition 

Administrator 

The administrator sits 'at the top of the cryptomarket hierarchy' and within this role has 
'full access to the cryptomarket' (Martin 2014a, 1 8). The administrator has an executive 
and managing role on the marketplace, is responsible for the policies on the marketplace 
and 'fulfils the role of treasurer with regard to cryptocurrency' (Martin 2014a; Van Slobbe 
2016, 79). 

Buyer 

Customers on cryptomarkets buy goods on vendors' seller pages, could provide feedback 
on these purchases and may be involved in discussions on forums (Martin 2014a). 

Bitcoin 

The most well-known and popular crypto-currency or Virtual currency, used on 
cryptomarkets to make purchases. On Silk Road, only Bitcoin was supported as a 
payment currency. Bitcoins are not issued by any government, bank or organisation, and 
can be purchased in person or through Online exchanges such as CoinBase. 

Crypto-currency 

'A peer-to-peer, client-based, completely distributed currency that does not depend on 
centralised issuing bodies (a 'sovereign') to operate. The value is created by users, and 
the operation is distributed using an open source cliënt that can be installed on any 
computer or mobile device' (Guadamuz & Marsden 2015) As a Virtual asset, rather than 
traditional printed units of fiat money, cryptocurrency cannot be destroyed or lost 
completely and new units are impossible to create. 

Crypto-exchangers 

Crypto-currencies can be purchased through Online exchanges such as CoinBase. 

Clear net (or clear 
web or surface web) 

The open part of the Internet that is indexed by search engines. 

Clear net market or 
web shop 

Business-to-customer shopfronts on the surface web or open Internet with typically one 
vendor only. Clear net markets tend to sell primarily legal drugs. 

Cryptomarket 

Online marketplace on the hidden part of the web that has been intentionally hidden and 
is inaccessible through Standard web browsers. It sells illegal drugs and other goods and 
services and customers can search and compare products and prices across multiple 
vendors (EMCDDA, 2015a). 

Customer feedback 

When making a purchase, customers are strongly encouraged to leave feedback. This 
feedback is posted underneath each listing and usually includes a date, a message (e.g. 
'great product, fast delivery, would repeat business') and a score. Customer feedback as 
a proxy for transactions will always result in an extent of under-estimation of actual 
transactions (Aldridge & Décary-Hétu 2014; 2016a; Christin 2013; Soska & Christin 

2015; , Décary-Hétu et al., forthcoming). 


Dark net (or dark web The hidden part of the Internet that is not indexed by search engines (Aldridge & Décary- 
or hidden web) Hétu 2014; Martin 2014a). 

Dread Pirate Roberts Pseudonym of Ross Ulbricht, creator and administrator of Silk Road 1.0 He was convicted 
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Deep web 

of money laundering, computer hacking and conspiracy to traffic narcotics in February 
2015. 

Part of the Internet not accessible through traditional search engines (EMCDDA 201 5a). 

Developer 

Developers in the context of this report are primarily responsible for designing the 
technical infrastructure on Online drug markets. 

Drugs 

In this report we refer to drugs as the umbrella term of illicit drugs (such as heroin, 
cocaine, cannabis, amphetamine, methamphetamine and ecstasy), stimulants and 
synthetic drugs (NPS), excluding substances such as tobacco, prescription drugs and 
alcohol. 

Encryption 

The process of taking data that is readable and making it unreadable by using algorithms 
to create complex codes out of simple data to block access to information (Cyber Experts 
Blog at National Cybersecurity Institute 2015). 

Exit scam 

Scam whereby the site's administrators suddenly take the market offline and steal users' 
money kept in their escrow accounts (Woolf 2015). 

Finalise early 

A circumvent escrow that ensures direct payment without funds first being held in escrow 
as a backup measure in times of high concerns for exit scams or law enforcement seizure, 
reducing the risk that vendors and buyers lose the funds held in escrow. 

Escrow 

An arrangement in which the keys needed to decrypt encrypted data are held in escrow 
so that, under certain circumstances, an authorised third party may gain access to those 
keys. Payment is only released to the vendor when the buyer finalised the sale by 
indicating that the product had been delivered. 

Internet Service 
Provider (ISP) 

Organisation that provides services for accessing and using the Internet. 

Marketplace 

In the context of this study we refer to online marketplaces, which bring together multiple 
sellers in one location. 

Moderator 

The moderator 'are ranked below administrators in the cryptomarket hierarchy and assist 
with lower-level site maintenance and customer support' (Martin 2014a, 1 8) 1 . As such, 
the moderator has less access to the infrastructure of the marketplace and user information 
than the administrator (Martin 201 4a; Van Slobbe 2016). Moderators could receive a 
salary from the administrators (Martin 2014a). 


Multisignature escrow A cryptographic tooi that allows buyers to put bitcoins in an escrow account that requires 


New (or Novel) 
Psychoactive 
Substances (NPS) 

sign-off from two out of three porties - the buyer, the seller, and the website itself - to 
retrieve the funds. (Mounteney, Griffinths et al. 2016). 

"Substances of abuse, either in a pure form or a preparation, that are not controlled by 
the 1961 Single Convention on Narcotic Drugs or the 1971 Convention on Psychotropic 
Substances, but which may pose a public health threat" (UNODC 2015 ). They have 
been designed to mimic established illicit drugs (Druginfo 2015), and are also called 
'legal highs' as some may not be deemed illegal (yet). 

.onion domain 

Suffix indicating a hidden domain that can be accessed via the Tor network. 

Online pharmacies 

'A cybermarket for illegal distribution of drugs that are either unapproved by regulatory 
authorities, dispensed without a valid prescription, illegal versions of prescription drugs 
(some ineffective, out of date or contaminated), marketed with fraudulent health claims, or 


1 Responsibilities include: ‘regulating forum discussions; identifying fraudulent activity committed by scammers and 
responding to requests for assistance and complaints from vendors and consumers’ (Martin 2014a, p. 18). 
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Operation Onymous 

intended for recreational or criminal use.' (Maxwell & Webb 2008) The Internet has also 
facilitated the sales of prescription drugs in recent years (Scammel & Bo 201 6). 

Operation Onymous was an internationally coordinated police operation led by the FBI in 
the United States and involving authorities in 21 countries (Europol 2015). On 5 
November 2014, the FBI, together with the U.S. Drug Enforcement Administration, 
Homeland Security Investigations, and European law enforcement agencies acting 
through Europol and Eurojust, shut down multiple marketplaces including Silk Road 2.0. 

Opioids 

'Opioids are medications that relieve pain. They reduce the intensity of pain signals 
reaching the brain and affect those brain areas controlling emotions, which diminishes the 
effects of a painful stimulus' (National Institute on Drug Abuse 2014a). 

Peer-to-peer 

A system or network that does not have a central server but is distributed between 
participants (Greenberg 2016; Lewman 2016) 

PGP Key 

Pretty Good Privacy is a data encryption that provides end-to-end cryptographic privacy 
and authentication that vendors use to encrypt their Communications, whereby each 
individual has a unique PGP key (Cox 2016b). 

Reddit 

'Reddit is a website for Online content ranging from news and entertainment to social 
networking where registered members can enter and share content' (Finklea 2015, 4). 

Silk Road (or Silk 

Road 1.0 or SRI) 

The first large anonymous Online cryptomarket located on the dark net. It was founded in 
201 1 and was shut down by the FBI in 2013 (Aldridge & Décary-Hétu 2014; BBC 2013; 
Martin 2014). Several weeks after the taking down of Silk Road, Silk Road 2.0 was 
launched, which is why the former is also referred to as Silk Road 1.0 or SRI. 

Single-vendor shop 

A cryptomarket that is run by one vendor, which allows vendors to deal directly with their 
customers avoiding the risks associated with third party escrow or the need to pay a 
commission to the cryptomarket administrators. 

Stealth listings 

Vendors can create listings that are not available for public view, referred to as 'stealth' 
listings. Vendors send links to these listings privately, but transactions are still processed 
via the marketplace with escrow facilities remaining available to protect buyers (Aldridge 
& Décary-Hétu 2014). 

Stimulants 

'The use of stimulants increases alertness, attention and energy, and elevate blood 
pressure, heart rate and respiration' (National Institute on Drug Abuse 2014b). 

Tor 

Anonymising software that uses encryption to make it difficult for anyone to tracé IP 
addresses (i.e. codes assigned to each computer on the internet) (Barratt 201 2, 683). 

Vendor 

A vendor sells his or her (illegal) goods to customers through his or her own seller page 
(Martin 2014a). 

Web crawler 

Software that methodologically archives websites and extracts information from them. To 
do so, it starts at a fixed webpage (usually the homepage), downloads that page and 
parses it for hyperlinks to other pages hosted on the same website. It then follows each 
hyperlink, adding new hyperlinks it discovers to its list of pages to visit until no new pages 
are found. 

Web scraper 

A computer software technique to extract information from downloaded web pages 
identified by a web crawler. 
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1. Introduction 


In its two latest European Drug Reports, 2015 and 2016, the European Monitoring Centre for Drugs and 
Drug Addiction (EMCDDA 2015; 2016a), highlighted the rising importance of the role of the Internet 
in drug markets. Out on the streets, dealers and runners in retail markets for drugs serve a local customer 
base, who they typically meet face-to-face (May & Elough 2004). Despite the risks of scams or technology 
failures, the Internet has brought benefits to consumers and vendors. As in many other markets, such as 
travel, insurance or personal electronics, the Internet has improved transparency and choice for consumers 
and facilitated ways for drugs businesses to access potential customers and suppliers. Also, it has enhanced 
the efficiency and security of off-line criminal activities (EMCDDA 2016b). 

The role of the Internet in facilitating drugs trade has gained considerable attention since a publication in 
Gawker on ‘Silk Road’ (Chen 2011), the first large anonymous online marketplace located on the ‘dark 
net’, the hidden part of the Internet that is not indexed by search engines (Aldridge & Décary-Elétu 2014; 
Martin 2014a). These online marketplace platforms, called cryptomarkets, bring together multiple 
vendors listing mostly illegal goods and services for sale. 

Silk Road had emerged in 2011 and was shut down by the FBI in October 2013. lts administrator, 
operating under pseudonym Dread Pirate Roberts, was arrested and money that was held in deposit by 
the site were confiscated (BBC 2013). Soon after Silk Road was taken down, various similar marketplaces 
or copy cats emerged, among which a new version of the original Silk Road: Silk Road 2.0 (SR2). In 
November 2014, Europol (2014) announced the closing down of multiple dark websites including SR2. 
Not much later, several arrests were made in the Netherlands after taking down the online market places 
Black Market Reloaded and Utopia (Openbaar Ministerie 2015). 

It is not just the obscure corners of the Internet where drugs are being traded. The EMCDDA (2015a) 
detected 651 web shops on the surface web (or clear net, containing those web sites that are indexed by 
search engines) in 2013 with unregulated substances on offer, mostly so-called new psychoactive 
substances (NPS or ‘legal highs’), which are not regulated, but have a similar pharmacological basis to 
illegal drugs. 

As the Internet has had a revolutionary impact on many legitimate industries, the question is whether it 
has started to transform drug markets as welk While there is no lack of attention for these new trends in 
markets for illicit drugs, the evidence on their size, shape and evolvement is fairly limited. The extent and 
nature of this phenomenon and its impact is investigated in more detail in this report. 
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1.1. Objectives and scope 

This report aims to investigate the role of the Internet in facilitating drugs trade. It is commissioned by 
the Research and Documentation Centre (Wetenschappelijk Onderzoek- en Documentatiecentrum, 
WODC), the independent research arm of the Ministry of Security and Justice in the Netherlands. 
Special attention was therefore paid to the role of Dutch actors in facilitating this trade. 

The Netherlands appears to play an important role in international drug markets. It is the largest 
producer of ecstasy and herbal cannabis in Europe and a hub for the distribution of cannabis resin and 
cocaine (EMCDDA 2016a). Whether that role is replicated in the online world was analysed in this 
report. 

The overall aims of this study were: 

• To characterise the scope and the size of Internet-facilitated drugs trade; 

• To identify the role of the Netherlands in Internet-facilitated drugs trade; and 

• To delineate potential avenues for law enforcement for detection and intervention. 

When referring to the total scale and scope of Internet-facilitated drugs trade, this study considers trade 
via cryptomarkets as well as trade facilitated by the clear net. 

For reasons explained in Chapter 4, the emphasis of this report will be on cryptomarkets, especially the 
quantitative parts. Chapter 3 will also explain that previous studies have shown that cryptomarkets cover 
the vast majority of illicit drugs trade facilitated by the Internet, while clear net markets are dominated by 
new psychoactive substances (NPS). 

1.2. Research questions 

The Terms of Reference for this study specified a number of research questions. The research team 
amended these, based on the available sources and proposed methodologies. Consequently, the study 
focused on answering 22 research questions. These questions are divided into five clusters, looking at: 

A. Merchandise: the volumes and types of drugs and other goods and services traded; 

B. Cryptomarkets and other Internet-based market places: their numbers, workings and relevant 
trends; 

C. Shipping routes of drugs, including the role of the Netherlands; 

D. Actors involved in Internet-facilitated drugs trade and their modus operandi; and 

E. Avenues for detection and intervention. 

The table below lists these research questions and indicates the section in which their results are discussed. 
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Table 1.1. Research questions 


# 

Research questions 

Section 

A. Merchandise 

1 

Which types of drugs are being traded over the Internet? And how does the size of trade of 
different types of drugs relate to one another? 

4.3 and 

4.4 

2 

In which volumes are the drugs offered? To what extent do these volumes refer towards 
Wholesale or retail? 

4.5 and 

4.6 

3 

To what extent are goods and services offered in support of other activities in the drugs 
supply chain? 

4.7.1. 

4 

To what extent are the drugs offered in combination with other (legal or illegal) goods or 
services? If so, which ones? 

4.7.2 

B. Cryptomarkets and other Internet-based marketplaces 

5 

How many cryptomarkets and other Internet-based marketplaces exist where drugs are 
traded? How do these relate to each other in terms of listings? 

4.2 

ó 

To what extent do cryptomarkets and other Internet-based marketplaces put restrictions on the 
drugs trade? 

3.4.1 

7 

Which trends can we observe in the field of cryptomarkets and other Internet-based 
marketplaces where drugs are being traded? 

3.2 

8 

What are the possible trends that occur in terms of the number of vendors involved in drugs 
trade on the Internet and their listings? 

4.8 

C. Shipping routes 

9 

From which countries do vendors operate primarily? 

5.1 

10 

To which countries are vendors willing to ship? 

5.2 

1 1 

Are there indications that the Netherlands is an important country of origin for drugs trade 
on the Internet? 

5.1 and 

4.3 -4.7 

D. Actors involved in Internet-facilitated drugs trade and their modus operandi 

12 

Which actors are involved in the trade of drugs on the Internet? 

6 

13 

What is known about the developers and administrators of such marketplaces and websites? 

6 

14 

What can be said about the characteristics of these vendors? 

6.2 

15 

How does the payment of Internet-based drugs trade proceed? 

3.1.2 

16 

What is the modus operandi in the shipping of drugs? 

3.1.5 

17 

What can be said about (the development of) the size of the population of customers/buyers 
in the Netherlands? 

5.2.2 

18 

What can be said about the characteristics (age, criminal antecedents) of the 
customers/buyers? Which trends are occurring? 

6.3 

19 

What is the modus operandi in the buying and receiving of drugs? 

6.3.3 

E. Avenues for detection and intervention 

20 

Which broad strategies are available to law enforcement in the detection and intervention of 
the Internet-facilitated drugs trade? 

7.2 

21 

Which barriers do law enforcers face in the Netherlands in detection and prosecution of 
drugs trade on the Internet? 

7.2 

22 

What were the consequences of bringing down marketplaces? To what extent did any 
substitution effects occur? 

7.2.4 
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1.3. Structure of this report 

The next chapter provides an elaborate description of the methods used in this study and explains their 
limitations. Chapter 3 offers a primer on Internet-facilitated drugs trade. It explains many of the terms 
used and concepts analysed in the report, and introducés how these markets work. For those unfamiliar 
with those concepts, it may be helpful to review Chapter 3 first, because it defines much of the 
terminology used in Chapter 2. The chapter ends with a qualitative description of some important trends 
in this field. This remainder of the report is structured along the lines of the research questions. Chapter 4 
reports on the results of the study’s assessment of the size and scope of Internet-facilitated drugs trade, 
offering insights from our empirical data collection, and from interviews and the literature. Chapter 5 
looks into shipping routes of drugs traded via the Internet, and discusses the role of the Netherlands in 
particular. Chapter 6 reports on the characteristics and modus operandi of actors involved in Internet- 
facilitated drugs trade. Based on these findings and mainly insights from interviews, Chapter 7 
summarises four main avenues of detection and intervention by law enforcement. Finally, Chapter 8 
provides some overarching conclusions and answers each of the research questions listed above. 
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2. Methodology 


In order to address the research questions as defined for this study, a mix-of quantitative and qualitative 
methods was applied, consisting of: a review of the literature; in-depth interviews with experts and law 
enforcement representatives; collection and analysis of cryptomarket data; and a review of police case fdes. 
These methods are discussed in more detail below and additional information on the literature search 
protocol is included in Appendix B. 

The emphasis of this study was on drugs trade via cryptomarkets. Previous studies have shown that 
cryptomarkets are dominated by illicit substances (e.g. Aldridge & Décary-Hétu 2014; Soska & Christin 
2013), while clear net market places concentrate on new psychoactive substances (NPS). While 
developments in the availability and consumption of NPS have been highlighted as important trends (e.g. 
EMCDDA and Europol 2015; 2016), the emphasis of this study has been on trade of illicit substances via 
cryptomarkets. The quantitative assessment of the size and scope of this phenomenon conducted as part 
of this study was carried out through a method designed and developed by some of the report authors, 
involving the collection and analysis of scraped cryptomarket data (see Section 2.3 for an explanation of 
this method). Trade of NPS via clear net market places was primarily covered by literature review (see 
Section 2.1) and interviews (see Section 2.2). 

Table 2.1 provides an overview of the methods used to address the five clusters of questions identified in 
Chapter 1. 
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Table 2.1. OverView of study scope and methodologies 



Cryptomarkets 
(focus on illicit drugs) 

Clear net markets 

(focus on NPS) 

A. Merchandise 

Analysis of scraped data 

Literature review 

Interviews 

Case files 

Literature review 

Interviews 

B. Cryptomarkets and 
other Internet-based 
market places 

Analysis of scraped data 

Literature review 

Interviews 

Literature review 

Interviews 

C. Shipping routes 

Analysis of scraped data 

Literature review 

Interviews 

D. Actors and modus 
operandi 

Literature review 

Interviews 

Case files 

Literature review 

Interviews 

E. Avenues for detection 
and intervention 

Interviews 

Literature review 


Reading the methodological descriptions provided in this chapter may require some familiarity with the 
concepts and workings of cryptomarkets e.g (vendors, customer feedback, escrow, finalise early, etc.) and 
other online market places. Chapter 3 contains a detailed introduction to cryptomarkets and clear net 
markets for drugs for those not familiar with this field. 

2.1. Literature review 

The aim of the literature review was to identify, analyse and synthesise scientific and grey literature 2 about 
specific dements of Internet-facilitated drugs trade (both on the clear and dark net) and the options to 
detect and intervene in these practices. This review particularly focused on complementing aspects of the 
study’s scope that could not be covered in the analysis of scraped cryptomarket data, such as vendor and 
buyer characteristics and data on Internet-facilitated drugs trade on the clear net. The review did not aim 
to capture and analyse all literature or other sources available on the topic of Internet-facilitated drugs 
trade and should therefore not be understood as a comprehensive bibliography on the topic. For 
transparency and for further reference, all identified documents are listed in a bibliography in Appendix 
D. A sub-set of these documents were subsequently analysed. 

The process followed the following steps, which are a common approach to conducting literature reviews: 

1. Protocol development 

2. Identifying relevant literature 

3. Study selection 


2 Grey literature refers to those publications that are produced on all levels of government, academies, business and 
industry in print and electronic formats, but which is not controlled by (peer-reviewed) academie journals. 
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4. Data extraction 

5. Quality assessment, synthesising and interpreting the evidence 

A detailed description of the search strategy and consulted websites can be found in Box 2.1 on the next 
page and Table BI in Appendix B. 
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Box 2.1. Steps for conducting the literature review 


Step 1 . Protocol development 

• Defining inclusion and exclusion criteria for studies: 

o Inclusion: literature in English and Dutch, academie papers, reports from professional organisations, 
conference papers, investigative journalism. Exclusion: letters, news items. In ferms of topics, 
information on Online pharmacies was excluded. 

• Determining search ferms and search strings (Table BI in Appendix B) 

• Identifying sources to be searched 

o Open-source and subscription-only bibliographic databases (Table BI in Appendix B for a full list of 
databases consulted) 
o Google Scholar 
o Google 

o Searches within selected websites (Table B2 in Appendix B for a full list of websites consulted) 

o In addition to the Online searches, the study included literature written or indicated by research team 

members or provided by inferviewees 

o Furthermore, a snowballing approach was applied to references of the sources the project team 
considered to be most important in the field of Internet-facilitated drugs trade 

• The NVivo 3 coding frame was developed based on the research questions, allowing the software to mark 
those sections, paragraphs or phrases that provide insights into specific research questions. 

Step 2. Identify relevant literature 

• Conducting the full search on 3 and 4 January 201 6 

• Including additional materials as provided by members of the research team or inferviewees during later 
stages of the study 

• Over 300 articles were identified 

Step 3. Study selection 

• Reviewing study titles 

• Reviewing abstracts if inclusion/exclusion could not be determined based on title 

• just over 1 00 articles were defined as relevant for inclusion in the current study 

• Given the resources available for this study, it was decided that a total of 88 relevant (based on their titles 
and/or abstract) and available articles would be included for detailed analysis in a software package called 
NVivo.to extract information relevant to the research questions. Some of the excluded articles were still used 
for reference in particular parts of the study (e.g. the introduction chapter), yet were not analysed in 
accordance with steps 4 and 5 (this also applied to (additional materials identified by the research team or 
sent to the research team after the 88 articles were selected). See Appendix D for lists of included and 
excluded studies. 

Step 4. Data extraction 

• Reviewing and characterising selected papers/reports through using a coding frame in qualitative data 
analysis software NVivo 

• The coding frame was developed based on the research questions. Where sections, paragraphs or specific 
sentences in any of the selected sources provided insights into one or more of the research questions, they 
were marked in accordance with those research questions. 

Step 5. Quality assessment, synthesising and interpreting the evidence 

• Bringing together relevant evidence into a cohesive whole. 

• When synthesising and interpreting the evidence, aspects contributing to the rigour of these publications were 
taken into account, for example peer reviewed, or transparency in methods/data used. The relevance in 
relation to the research questions was also taken info account. 


3 NVivo is a qualitative data analysis (QDA) computer software package, designed for analysing very rich text-based 
and/or multimedia information. 
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2.2. In-depth interviews 

In order to further examine the characteristics of Internet-facilitated drugs trade and (possible) practices 
around detection and intervention, semi-structured interviews with experts in Internet-facilitated drug 
markets and with law enforcement representatives were conducted. In addition to these one-to-one 
interviews, a focus group was conducted with Dutch law enforcement representatives, in order to capture 
views from several stakeholders at once and to facilitate a group discussion around the study topic and to 
validate study findings to date. The interviews and focus group aimed to capture expert views on and 
knowledge of the topic in order to supplement the cryptomarket analysis and information gathered 
through the literature review. Given the international character of Internet-facilitated drugs trade, 
respondents from the Netherlands as well as other countries were interviewed. Approval from the Dutch 
police was granted for conducting interviews with Dutch law enforcement representatives. 

Selection and recruitment of interviewees 

The research team used a purposive sampling strategy for selecting the interviewees since there was a good 
understanding of the type of interviewees relevant for this research. 4 Due to its flexible nature, quota 
sampling — a form of purposive sampling — was used in which minimum quotas per interviewee category 
(experts and law enforcement representatives) were laid down. This procedure ensured ‘that key groups 
are represented in the sample, while providing flexibility in the final sample composition’ (Robinson 
2014, 34). In addition to the list of potential interviewees that the research team created, the team also 
received contact details via other sources, for example through members of the Scientific Steering 
Committee of this study and through interviewees. A contact person at the Dutch police assisted the 
research team in approaching law enforcement representatives and other experts in March 2016 and 
subsequently helped the researchers in setting up the logistics for the focus group, which took place in 
April 2016. 

Respondents for the individual interviews were contacted between December 2015 and April 2016. In 
those cases, where the candidate interviewees had not respondent after two reminders, they were 
considered a non-response. There were a few instances where respondents indicated that based on their 
organisation’s policy they could not take part in an interview. 

The table below lists interviewee numbers per category (expert or law enforcement interview) and the 
modes in which the interviews were conducted (i.e. in-depth interviews, focus group or in writing). A full 
list of interviewees is provided in Appendix E. 


4 As Robinson (2014) summarises it: ‘The rationale for employing a purposive strategy is that the researcher assumes, 
based on their a-priori theoretical understanding of the topic being studied, that certain categories of individuals may 
have a unique, different or important perspective on the phenomenon in question and their presence in the sample 
should be ensured’ (p. 32). 


9 



RAND Europe 


Internet-facilitated drugs trade 


Table 2.2. List of interviewees 


Type of interviewee 


Type of interview Total 


Experts in Internet-facilitated drugs trade ln-depth interview 

Dutch law enforcement representatives (e.g. police, public ln-depth interview 
prosecutor) involved in targeting Internet-facilitated drugs trade 

Dutch law enforcement representatives with knowledge of detection, Focus group 
investigation and prosecution (i.e. police, anti-fraud agency, 

(forensic) research organisations) 


8 

6 

6 


Representatives of European and international agencies involved in ln-depth interviews and in 6 
targeting Internet-facilitated drugs trade writing 


Total number of interviewees consulted 


26 


Conducting the interviews 

In advance and reiterated at the start of the interview, respondents were provided with an information 
sheet (included in the invitation email) that provided details of the study, confirmed that interviewees’ 
participation was voluntary, set out about how information provided would be attributed and asked 
interviewees’ consent for audio-recording of the interview. For the in-depth interviews, respondents were 
informed that the information they provided would not be attributed to named individuals and were 
asked if information could be attributed to them using general roles or types of organisation instead (for 
example ‘law enforcement expert’ or ‘expert’). The focus group was held under the Chatham House Rule 
in which fmdings were not attributed to individual members of the focus group. 

The majority of the expert and law enforcement interviews were conducted in a one-to-one setting (with a 
few interviews in which two respondents took part), either by phone or face-to-face, and the interviews 
were recorded for note-taking purposes after consent of the interviewees. A topic guide was prepared in 
advance of the interviews, covering the main research questions. The topic guide used for the in-depth 
interviews is included in Appendix F, and key focus group questions are listed in Box 2.2 below. The 
topic guide and focus group questions followed a semi-structured approach that left room for elaboration 
or additional questions to be raised and discussed. 

Box 2.2. Key focus group questions 

How does Internet-facilitated drugs trade relate to the global (offline) drugs trade? What will be the trend in 
the long term? 

The what extent has Internet-facilitated drugs trade taken over a part of the Street trading / or has it tapped 
into a new market of users who previously did not (or hardly) bought drugs? 

What are the priorities in tackling Internet-facilitated drugs trade? 

What are possible targets for detection and intervention of Internet-facilitated drugs trade? What are the 
possibilities for detection and intervention during the different parts of the supply chain (production excluded)? 

What are the advantages and disadvantages of these targets, and what obstacles must be overcome? 
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Although the research team raised these questions during the interviews and the focus group, the extent to 
which they were answered depended on the information provided by interviewees. For example, as 
appropriate given the topic, law enforcement representatives and experts could not answer certain 
questions that would require discussion of sensitive information relating to ongoing investigations or law 
enforcement methods, sources and approaches. This particularly limited the extent to which this study 
could answer the research questions regarding avenues for intervention and detection. 

When information from the interviews was unclear or when it was not clear if information could be 
brought in the public domain, the research team followed-up with relevant interviewees for clarification 
and/or verification. Via email, interviewees were also asked to confirm if and how they preferred to be 
mentioned in the list of interviewees, and were provided with an example on how interviewee data would 
be used in the report. All interviewees agreed with how their data would be used for this report. In 
addition, a representative of the Dutch police reviewed this report in advance of its publication to ensure 
that no sensitive information on detection and intervention practices was included. 

Analysis and reporting of interview data 

Detailed interview notes were taken during the interview and analysed by members of the research team 
using an approach in which different themes relevant to the research questions were identified and 
clustered. The analysis looked for areas of agreement and disagreement both between and within different 
categories of interviewees (experts or law enforcement representatives). Interview data were then 
incorporated throughout the report where they complemented or contested findings from the 
cryptomarket analysis or literature review. Interviewee codes are used in the report to indicate the type of 
interviewee (‘EX’ for ‘expert’ and ‘LE’ for ‘law enforcement expert’). The numbers added to these codes to 
not reflect the order of interviewees listed in Appendix E. Focus group participants are referred to as one 
group. 


2.3. Quantitative analysis of cryptomarket data 

This study collected new, primary data from cryptomarkets, web sites selling licit and illicit products and 
services on the dark web. This was done through the use of the DATACRYPTO software tooi, designed 
by Décary-Flétu and Aldridge (2013) specifically designed for the purpose of collecting information about 
Online drugs transactions. Table 2.3 presents the eight cryptomarkets monitored for this report, including 
their date of creation, the number of listings and the number of vendors. These cryptomarkets were 
selected by the research team based on their size, their focus on specific types of products or their origin; 
for example, French Dark Net is designed for French users. The way in which the DATACRYPTO tooi 
works means that it cannot be used on some cryptomarkets. For instance, Outlaw, Valhalla, TheRealDeal 
and Dr. D are markets that were programmed in such a way that the DATACRYPTO tooi was unable to 
stay logged in and collect data. We believe that this is more the result of anomalies in the programming, 
rather than the use of active crawling countermeasures. The German-Plaza cryptomarket focused mainly 
on hacking services and stolen financial information and was therefore not crawled. 
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Table 2.3. Descriptive statistics of cryptomarkets 


Cryptomarket 

Date of creation 0 

Number of listings 

Number of vendors b 

AlphaBay 

2014/12/22 

37,896 

2,001 

Cryptomarket 

2014/12/22 

8,362 

432 

Dark Net Heroes League 

2015/05/27 

387 

76 

Dreammarket 

2013/11/13 

22,284 

847 

French Dark Net 

Unknown 

1,307 

331 

Hansa 

2015/07/18 

4,829 

219 

Nucleus 

2014/10/24 

26,538 

1,013 

Python 

2015/07/10 

4,208 

144 

Total 


105,81 1 

5,063 


NOTE: 


a Information about the date of creation of cryptomarkets was collected from DeepDotWeb (201 6a). 

b Vendors who operated on multiple cryptomarkets were included in the count of vendors for each cryptomarket 
where they operated. The total number of vendors is therefore not indicative of the unique number of vendors active 
on cryptomarkets in January 201 6. 

2.3.1. Dato collection method 

The data for this report were collected over a period of five days starting on January 1 T h , 2016 using the 
DATACRYPTO software tooi developed by Décary-Hétu and Aldridge (Décary-Hétu & Aldridge 2013; 
Aldridge & Décary-Hétu 2015a). DATACRYPTO is a web crawler/scraper class of software that 
systematically archives websites and extracts information from them. Once a cryptomarket has been 
identified, DATACRYPTO is set up to log in to the site and download its contents. To do so, it starts at a 
fixed webpage defined by the researchers (usually the homepage). It first downloads that page and parses it 
for hyperlinks to other pages hosted on the same website. It then follows each hyperlink, adding new 
hyperlinks it discovers to its list of pages to visit until no new pages are found. At that point, 
DATACRYPTO switches from its crawler to scraper mode and starts extracting information from the 
pages it has downloaded. Each data point is coded by the researchers who teach DATACRYPTO what to 
look for (for example product titles, prices, product descriptions). DATACRYPTO stores data from all of 
the websites it crawls and scrapes in a unified database that allows for cross-market queries such as: who 
are the vendors of cannabis operatingfrom the Netherlands in all cryptomarkets? We note (and discuss further 
in later sections of this report) that the data that can be collected via crawling and scraping from a drug 
cryptomarket relates primarily to the supply side: we cannot ascertain location or any other characteristics 
of buyers. 

As well as analysis of new data collected for this study, analyses related to trends are based in part on data 
that were collected on Silk Road 1.0 between September 13 th and September 15 th 2013 using the same 
DATACRYPTO tooi. The earlier version of DATACRYPTO used by members of the research team to 
collect these data worked in exactly the same way, but with a reduced level of automation. In both the 
earlier and current versions of DATACRYPTO, the end result is identical: a list of all listings that were 
Online at one point in time; in this case, on or just after January 1 l th 2016. 


12 






Internet-facilitated drugs trade 


RAND Europe 


Using a single crawl to study cryptomarkets may be problematic as a crawler may appear to have crawled 
an entire cryptomarket when it in fact only indexed a part of it (see Soska & Christin 2015 for a 
discussion of this issue). This can happen when the Tor network itself is having reliability issues, when the 
cryptomarket is actively logging out the crawler, requiring it to log back in again or when the 
cryptomarket itself goes offline. For larger cryptomarkets that take days to crawl, it is also possible for 
listings to go offline and for new ones to be created during the crawl. Our DATACRYPTO tooi was 
designed to deal with these issues from the start. It is a state-aware software, meaning that the result of 
each request is analysed and logged by the software. If the Tor network or the cryptomarket was down, it 
would know to stop and try to continue its crawl a few minutes later. If a request for a page returned a 
different page (e.g. asking for a listing page and receiving the home page of the cryptomarket), the request 
is marked as failed and added to the count of failed pages. 

During the January crawl, all markets had a well below five per cent failed request rate. DATACRYPTO 
is also able to detect whether it is logged in or logged out of a cryptomarket and to login autonomously if 
needed. During the January crawl that produced the data used in this report, on the occasions that 
DATACRYPTO was unable to re-establish the log-in itself, it sends an email to researchers who are able 
then manually to log back in. For some cryptomarkets, this manual login had to be repeated dozens of 
time in order to complete the crawl; for other cryptomarkets, this was never necessary. The only issue with 
the completeness of our crawl is the fact that some larger cryptomarkets like Alphabay have over 500,000 
web pages that need to be indexed. This needs to be spread over a period of days, days during which the 
cryptomarket itself is changing. This issue is offset by the slow churn of listings over a period of five days 
and the fact that new listings are also indexed by the crawler. 

2.3.2. Methods for estimating measures 

The ‘big data’ generated by crawling and scraping cryptomarkets cannot be used to generate analysis and 
understanding uncritically, and therefore must be manually checked, cleaned and recoded before it can be 
analysed. Furthermore, due to several potential caveats, we make conservative assumptions and provide 
lower bound estimates on the size and scope. Estimates in this study, therefore, err on the side of not over- 
estimating or misleading the size and scope of the market. The approach taken to the following issues are 
explained below: 

• how we treat holding process; 

• how we count the number of transactions; 

• how we estimate monthly revenues; 

• how we identify shipping routes; 

• how we generate product categories; 

• how we estimate quantities; 

• our approach to vendor name matching; and 

• dealing with stealth listings. 
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2.3.2.1. Holding prices 

One issue we faced is related to prices, and more precisely, to holding prices on listings. Vendors 
somedmes increase the price of a listing by an order of magnitude when out of stock or otherwise 
unwilling/unavailable to process transactions. This technique of using holding prices has the advantage for 
the vendor of keeping a listing active with all of its associated customer feedback, while simultaneously 
deterring customers from making purchases as a result of the abnormally high price of the listing. Holding 
prices are problematic when taken as indicative of ‘actual’ market prices, as they will distort estimations of 
drug prices, revenues and price per unit of drugs. 5 

To identify listings with possible holding prices, we created a historical database of the prices of listings 
from previous crawls and scrapes of cryptomarkets that were made in the months prior to the data 
collected for this report using the same DATACRYPTO tooi. Instead of using the most recent price 
associated with a listing derived from our data collection, we used its median price, thereby excluding 
occasional high prices collected for any one listing. This historical database contained an average of 4.4 
prices for each listing (Min = 1.0; Max = 14.0; S.D. 3.4). A similar technique was used by Soska and 
Christin (2015) to deal with the potential distorting effect of holding prices. Of course, this technique 
does not eliminate all holding prices since some newer listings have no historical prices. 

2.3.2.2. Number of transactions 

A second estimation issue relates to the number of transactions facilitated by cryptomarkets. The size and 
scope of cryptomarkets is one of the main research questions for this report and to measure it, it is 
essential to calculate the number of purchases made connected to each listing over a period of time. 
Unfortunately, cryptomarkets do not post publicly the transactions they facilitate and researchers must 
use a proxy to estimate transactions. All past research into cryptomarkets (Aldridge & Décary-Hétu 2014; 
2016a; Christin 2013; Décary-Hétu et al. forthcoming; Soska & Christin 2015), has used customer 
feedback as the best and only proxy to estimate transactions. When making a purchase, customers are 
strongly encouraged to leave feedback. This feedback is posted underneath each listing and usually 
includes a date, a message (e.g. ‘ greatproduct, fast delivery, would repeat business) and a score. 

The percentage of feedbacks received 

Customer feedback as a proxy for transactions will always result in an under-estimation of actual 
transactions. Some customers may be unwilling to leave feedback or may forget to do so after a shipment 
has been received. Information regarding the proportion transactions without feedback is scant. To 
estimate it, Aldridge and Décary-Hétu (2014) compared the number of feedbacks their DATACRYPTO 
tooi had collected to the number of transactions advertised on the vendors’ profiles on SRI. Their analysis 
showed that 88 per cent of transactions at the time led to a public feedback. The same method was used 
by the authors to update the extent of underestimation when data were collected for the present analysis 
in January 2016. Only one cryptomarket active in 2016 provided a useable vendor transaction metric: 


5 Whilst increasing prices as supply falls is a typical economie behaviour, ‘missing prices’ would be typical when 
firms have no supply. However, vendors in this market cannot take their good off the market and instead provide 
extreme, obviously unrealistic ‘holding’ prices. We reduce the impact of these extreme prices by using the median. 


14 



Internet-facilitated drugs trade 


RAND Europe 


DreamMarket. Based on this limited sample (N = 1,129 vendors), 71 per cent of transactions of vendors 
were captured through feedbacks. Similarly, a law enforcement representative (LE2) stated that their 
intelligence suggest that 80.6 per cent of transactions lead to public feedback on large cryp tornar kets; a 
figure that is right in between the two DreamMarket estimates. 

These estimates suggest that the number of feedbacks should be multiplied by between 1.14 and 1.41 to 
better estimate the true number of transactions. Doing so, however, assumes that the DreamMarket- 
obtained estimate is representative of all cryptomarkets in connection to the number of missing feedbacks 
we were able to detect. This is highly unlikely since the design of each cryptomarket varies in terms of 
how much it is a default and/or explicit for customers to leave feedback. 

Some cryptomarkets may also send reminders to customers who have failed to leave feedback or may not 
require that repeat customers leave feedbacks for each purchase of the same listing. Combined, these 
limitations make any multiplier based on the partial data available to us limited to only one marketplace 
sufficiently unreliable that we elected to refrain from providing range estimates for transactions. As 
explained below, however, we do provide an overall upper-boundary estimated for the total monthy 
revenues (see Section 2.3.2.3). 6 

The moment of capturing the feedback 

Another issue relating to the number of transactions relates to the moment of capturing the feedback. 
Given the growth of cryptomarkets over the past years (Soska & Christin 2015), the number of 
transactions on cryptomarkets overall has increased steadily. To better estimate the latest trends, this 
report estimates transactions that occurred during the month before the data collection. Transactions are 
based therefore on feedbacks with a post date between 11 December 2015 and 10 January 2016. Because 
feedbacks occur at some point subsequent to the transaction date, these feedbacks will (1) include some 
purchases made prior to the data collection period; and (2) exclude some purchases made during the data 
collection period, for which feedback had yet to be posted. Other feedbacks may be unaffected by the 
delay between purchase, and shipment receipt when customers ‘fmalised early’ (that is, paid for goods 
prior to their receipt). Cryptomarkets do not contain information about transaction date, and although 
we use feedbacks as a transaction proxy measure, this should be understood as the moment when funds 
are released from a customer to a vendor in situations when customers leave feedback, and not when a 
drug was purchased or delivered. We therefore believe that this will not have impacted our estimate of the 
number of transactions. 

The turnover of listings on cryptomarkets 

The final issue regarding the number of transactions is that of the high turnover of listings on 
cryptomarkets. Listings only remain Online for a few weeks on average and vendor accounts themselves are 
only online for 220 days on average (Soska & Christin 2016). Since the DATACRYPTO tooi only 


6 We further investigated to see if the extent to which feedbacks underestimated transactions was related to the price 
of a listing. We calculated for each vendor the extent of underestimation and correlated this with the average value of 
the products sold by that vendor. The Pearson correlation was not significant suggesting that the extent of 
underestimation is not related to price. Similarly, a law enforcement official (LE2) States that their intelligence 
confirms these findings. 
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collected the listings during the week of 11 January 2016, it did not collect all of the listings that were 
active during the feedback sampling period from 11 December 2015 to 10 January 2016. As such, it was 
unable to count the feedbacks associated to those listings. To compensate for the missing listings, a new 
methodology was developed in Aldridge and Décary-Hétu (2016a) and used once again in Décary-Hétu 
et al. (forthcoming). It assumes that during the sampling period, the number of listings was fairly similar 
to those during the crawl period (the week of January 1 lth 2016). It also assumes that the missing listings 
transacted at about the same rate as those that were online during the crawl period. In other words, we 
assume that the listings that disappeared during the feedback sampling period were replaced by similar 
listings and that the missing feedbacks can be estimated using the active listings. To do so, we ‘scale up’ 
the number of feedbacks for the listings that were placed online after the initial date of the feedback 
sampling period by multiplying their daily rate of transaction by 30. So, for example, if a listing had 
received five feedbacks in the ten days since it was first posted by the vendor, its number of feedbacks was 
multiplied by three (to 15) to allow us to make appropriate comparisons across listings with varying 
lifespans. More research will be needed to evaluate precisely the accuracy of this methodology, but it is at 
the time of writing, the only approach available in the literature to compensate for missing listings 
however and should improve the accuracy of the estimates. Therefore, it was used in this study. 

2.3.2.3. Monthly revenues 

Cryptomarkets do not make publicly available the revenues of their vendors. To estimate monthly 
revenues, we multiplied the number of feedbacks of each listing by its median price. This provided us with 
a lower-bound estimate of the revenues generated on cryptomarkets for the month preceding 11 January 
2016. Of course, these represent gross revenues and the actual profits from these revenues are unavailable 
and notoriously difficult to estimate self-employment costs. 

We note here that across the eight cryptomarkets the majority of all marketplace listings (79 per cent) 
generated no transactions; 72 per cent of drug listings generated no sales. Listings with at least one 
transaction were therefore more numerous for drug (28 per cent) than non-drug (11 per cent) listings. 
Moreover, having at least one transaction associated with a listing was not evenly spread across listing 
price. For drug listings, this was most common among lower priced listings (36 per cent of listings up to 
$100) and dropped in a linear fashion for higher priced listings (8 per cent listings priced over $1000). 

It is important to understand whether the month relevant to our data collection (mid-December to mid- 
January) is representative of drug purchasing at other times of the year. Research has shown that substance 
consumption (both alcohol and drugs) varies by month/season (Cho et al. 2001; Del Rio; Lai et al. 2013; 
Prada et al. 2002); use is typically higher during holiday periods, with December often the peak month. 
To our knowledge, there is no research examining seasonal variation in drug buying. Although we might 
expect drug use and drug purchasing generally to occur at roughly the same time, drug users may 
purchase in advance of their use, and we reason that this is particularly likely to be the case for customers 
making purchases for personal use on cryptomarkets (and even more likely to be the case for cryptomarket 
customers who are drug dealers sourcing stock for offline distribution). One the one hand, our data 
collection refers to a period that overlaps with what is typically an increased consumption period for drug 
users (December) as well as a period typically associated with decreased use (January), suggesting that 
seasonal differences may be cancelled out. On the other hand, cryptomarket users must make purchases in 
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advance of rheir use to take into account processing and delivery times, suggesting that most cryptomarket 
drug-buying intended to supply seasonally inflated use in the December period will have occurred in 
November and early December, thus prior to the period to which our data collection refers. This 
‘reasoned guesswork’ leads us to suggest that the period to which our data collection refers may include 
fewer transactions than might have been the case had our data collection referred to October or 
November. It is therefore consistent with our aim to generate lower bound estimates. 

When estimating an upper-boundary estimate of the total monthly drugs revenues on cryptomarkets 
(Rmax)’ we use the following formula: 

n _ Rmin 

Rmax — r 

VJscraped 

whereby fscraped ' s the fraction of total listings on all cryptomarkets scraped. In Section 4.2.1 we explain 
that the January DATACRYPTO scrape on which our results are based captured about 80 per cent of all 
listings across all cryptomarkets. It is likely that the revenues per listing on cryptomarkets not scraped by 
DATACRYPTO are lower than those that are scraped, because revenues per listing tend to correlate with 
the size of a cryptomarket. This means we assume that the 20 per cent of the listings not covered by the 8 
scraped cryptomarkets generate no more than 20 per cent of revenues. 

Furthermore, R m i n is the lower-boundary estimate, q> is the fraction of transactions for feedback is 
provided. We assume that, if buyers leave feedback in only 71 per cent of transactions (c.f. DreamMarket 
estimate, see Section 2.3.2.2), the total revenues would be a maximum of 41 per cent higher 
(1/0.71 = 1.41). Intelligence from a law enforcement representative (LE2) suggests that larger transactions 
(e.g. over $1,000) are more likely to generate feedback than smaller ones. Therefore, it seems reasonable 
to assume that the multiplier of ^ /qj (in this case, 1.41) will generate an upper-boundary estimate. This 
estimate does not include revenues via potential stealth listings (see Section 2.3.2.8), nor does it 
compensate any potential seasonal effects (see above), as there is no information about these phenomena 
to draw any meaningful assumptions. 

2.3.2.4. Shipping routes 

Cryptomarkets provide us with data about countries or regions from which vendors indicated they ship 
products as well as countries or regions to which they are willing to ship. This information is included on 
each listing page. Researchers use this information as a proxy for a vendor’s country of operation (e.g. 
Aldridge & Décary-Hétu 2016a; Christin 2013), but as with using customer feedbacks as a proxy for 
transactions, this approach has limitations. For example, a vendor from Germany could advertise a listing 
as ‘shipping from’ the Netherlands. It is impossible to verify the true country of operation for vendors 
using simply quantitative data collected on cryptomarkets. 

Bearing these caveats in mind, our country-based analyses used these ‘shipping’ location data. They were 
cleaned manually. Countries where goods were shipped from and to were aggregated at the region and 
continent levels using a list published by the UN (UNSTATS 2013). 7 When listings indicated products 
would be shipped worldwide, or to multiple regions that spanned our categorisation scheme, we coded 


7 As of 23 June 2016: http://unstats. un.org/ unsd/methods/m49/m49regin.htm 
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these as ‘Worldwide/multiple regiems’. Where the origin or destination of listings could not be 
determined, listings were categorised as Unknown. Note that in the report we use terminology such as 
‘Dutch vendors’. For clarity: this actually means only that a vendor stated that the product on a listing 
would be ‘shipped from’ the Netherlands. We acknowledge that it is possible that ‘Dutch vendors’ as 
assessed in this way may not reside in or operate from the Netherlands, and indeed that actual ‘Dutch 
vendors’ may indicate a different ‘ship from’ region. We use this phrasing (consistent with other 
published research) for ease of expression. 

The tables we produced involving analysis by country will of necessity involve some doublé counting. For 
example, a vendor with one listing that ‘ships from’ the USA and another that ‘ships from’ the UK will be 
counted twice. For this reason, summing would provide totals that would exceed the number of vendors 
we estimate to be in the sample. We have therefore excluded totals in the tables. The possibility that 
vendors can list different ‘ship from’ locations for different products is an illustration of the limitation of 
using these data as a proxy for vendor location. Although it seems likely that most vendors will accurately 
list their location (not least to avoid deception and potentially negative feedback from customers arising 
from this), there may be valid reasons vendors list ‘ship from’ locations that do not coincide with their 
location. We consider some of these in the report. 

2.3.2.5. Product cotegories 

Cryptomarkets allow vendors to categorise their listings using a pre-existing set of categories. The 
AlphaBay cryptomarket for example offered 99 different product categories including more general ones 
for Drugs and Chemicals and more specific ones for jewellery. Markets typically allow drug vendors to 
classify the product being listed for sale into drug sub-types (e.g. ‘cannabis’, ‘opiates’, ‘prescription’). In 
our earlier cryptomarket research, we found that vendors did not classify drugs in a consistent manner (see 
Aldridge & Décary-Flétu 2016a). Moreover, categorisation schemes across multiple markets differ 
substantially, and cannot be combined. We therefore created our own categorisation scheme. Drug- 
related listings were placed into one of eight categories (plus one ‘other’) and the other listings into 10 
categories, some of which included drug-related products (e.g. bongs, scales) (see Appendix A). Some 555 
listings (0.5 per cent) could not be categorised due to a lack of information. The non-drug-related listings 
were eclectic, ranging from stolen cars to eBooks on how to date. The coding process was done by 7 
coders supervised by the two of the study authors David Décary-Flétu and Judith Aldridge. Coders did 
not code the same listings but were all asked, at the end of the coding phase, to code a sample of 200 
listings selected at random to measure their inter-rater agreement. Based on intra-class correlation using a 
two-way mixed model, the coders’ inter-rater agreement stands at 99 per cent. 

2.3.2.6. Quantities 

Cryptomarkets do not list the quantity of products (i.e. drugs, credit cards, etc.) or the advertised purity of 
drugs in a field that would be possible to extract automatically from the listings in a reliable fashion. 
Instead, coders manually extracted this information from the title of the listings and in many instances, 
using additional information from the more detailed textual description contained in the listings. The 
coding process was done by five coders. Coders did not code the same listings but were all asked, at the 
end of the coding phase, to code a sample of 200 listings selected at random to measure their inter-rater 
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agreement. Based on intra-class correlation using a two-way mixed model, their inter-rater agreement 
stands at 100 per cent for quantity, 98 per cent for number of units and 100 per cent for purity. 

2.3.2.7. Vendor name motching 

Many vendors placed listings on more than one market (also indicated by EX18). In some cases, vendors 
may also want to open multiple accounts on the same market, although they may be deterred from doing 
so due to the costs incurred through the marketplace requirement for vendors to pay a ‘bond’ in creating 
accounts. To identify the accounts that belong to the same individual or group, we compared the 
encryption keys 8 that vendors used to encrypt their Communications. This encryption key is by defmition 
unique, and other researchers have used encryption keys as a way to identify different vendor accounts 
belonging to the same vendor (Broséus et al. 2016; Soska & Christin 2015). Our initial dataset included 
5,083 vendors. Some 4,116 vendor accounts (81 per cent) had an encryption key associated to them 
either in the vendor description or in a product description, allowing us to match vendors. We found 
2,902 unique encryption keys, which, when adding the 967 vendor accounts without an encryption key, 
reduced our population of vendors to 3,869. We were able to further match 23 vendors based on their use 
of identical profile descriptions, leaving us with a final dataset that includes 3,846 vendors. Vendors had 
between one and five accounts (M = 1.32; SD = 0.652). Where vendors created multiple accounts with 
different vendor names, vendor descriptions and encryption keys, it is impossible for us to match the 
vendors; our estimate of the number of vendors is therefore an upper estimate of their numbers. 

2.3.2.8. Stealth listings 

All of our analyses were based on publicly available listings on dark net cryptomarkets (i.e. listings that 
anyone able to navigate to the cryptomarket would be able to see). It is possible for vendors to create 
listings that are not available for public view, referred to as ‘stealth’ listings. Vendors send links to these 
listings privately, but transactions are still processed via the marketplace with escrow facilities remaining 
available to protect buyers. There is no way of knowing precisely how many non-public listings are 
available , although analysis of data collected from potentially seized cryptomarket servers may provide 
some insights. Our count of listings will therefore be an underestimate due to the existence of these 
hidden listings (Aldridge & Décary-Hétu 2014). 

2.4. Case file analysis 

In order to complement fmdings from the literature and interviews, an analysis of Dutch police case files 
was conducted. The primary aim of the case file analysis was to further illustrate the characteristics (e.g. 
age, antecedents where possible, etc.), and where possible modus operandi of vendors, administrators, 
developers, moderators and other actors involved in Internet-facilitated drugs trade. 


8 Vendors used Pretty Good Privacy (PGP) encryption keys, which is a Standard in the security industry to encrypt 
messages. 
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Following exploratory discussions with representatives from the Dutch Public Prosecution Service 
(Openbaar Ministerie) one case 9 , consisting of several files and involving vendors, administrators, 
developers and moderators, was selected for in-depth analysis. Relevant institutions 10 granted approval for 
access to and analysis of this case. To ensure anonymity of the actors involved in this case, identifiable 
personal details included in the files such as full name were not recorded nor reported by the research 
team. Representatives of the Dutch Public Prosecution Service and the Dutch Police reviewed the case file 
information included in this report in advance of publication to ensure no confidential information or 
personal identifiers were included. 

Findings from the case file analysis are not representative of all actors involved in Internet-facilitated drugs 
trade, and are solely included to provide information supporting, challenging or complementing the 
findings of the literature review and interviews. Information included in the files was mainly based on 
observations by law enforcement officials (e.g. summaries of interrogations) and self-reporting by suspects 
involved (e.g. information provided during interrogations). As such, these findings should be treated with 
caution. Finally, it was not possible to make firm statements about criminal antecedents (if it was 
mentioned at all this was self-reported by actors during interrogation) or about where vendors obtained 
their drugs due to limited availability of (or in some cases absence of) information on these issues in the 
case files. 


9 For confidentiality reasons it was not possible to include additional information on the total number of cases from 
which the case was selected. It can, however, be noted that the volume of cases was limited. 

10 These include: Public Prosecution Service [Openbaar Ministerie), Dutch Police [Nationale Politie) and Council for 
the Judiciary [Raad voor de Rechtspraak). 
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3. An introduction to Internet-facilitated drugs trade 


This chapter offers an introduction to the workings of and terminology used for Internet-facilitated drugs 
trade, based on the available literature and interviews. This chapter primarily addresses research questions 
focussed on cryptomarkets and other Internet-based marketplaces (research questions’ clusters B, and 
partially D, see Table 1.1). 

Drug markets operating on the clear net appeared to be primarily associated with distribution of either 
non-controlled substances or substances for which legal Controls differ between countries and jurisdictions 
(EMCDDA 2016b). Trade of illicit substances tends to be concentrated on online market places on the 
dark web accessible only via anonymising software (such as a Tor browser) that uses encryption to make it 
difficult for anyone to tracé IP addresses. In this chapter we focus primarily on drugs trade via 
cryptomarkets as well as web shops on the clear net. The description is intended as a general overview and 
introduction to Internet drugs trade. There are several other resources available that offer a more detailed 
account of these phenomena. 11 


3.1. Drugs trade via cryptomarkets 

This section discusses the features of cryptomarkets and explains how they work. We use the term 
‘cryptomarkets’ (c.f. Aldridge & Décary-Hétu 2014; 2016b; Barratt 2012; Martin 2013;), following early 
use of this term in hacker forums (Aldridge & Décary-Hétu 2016b), but we note that the term ‘dark net 
markets’ also becomes more established (e.g. Buxton & Bingham 2015). Cryptomarkets look similar to 
regular online market places, such as eBay or Amazon, by allowing their customers to search and compare 
products and rate vendors). Hidden locations on the Internet, accessible only via anonymising software, 
such as a Tor browser, are home to a number of online marketplaces where the sale of drugs, legal highs, 
poisons, weapons and stolen data makes it a multi-million dollar industry (Cox 2015b). While there were 
some subtle differences between cryptomarkets, we have generalised their characteristics and features in 
this section. 

One of the features of these cryptomarkets is the ability for users to operate anonymously. Cryptomarkets 
employ anonymisation services such as ‘Tor’ 12 , which hide a computer’s IP address when accessing the site 
and obscure its identity. Identification of the person using the Tor or other anonymising software is 
difficult due to the fact that the architecture and encryption of the Tor network is impervious to most 


11 See for example: EMCDDA (2015a; 2016). 

12 See: https://www.torproiect.org/ , as of 6 November 2015. 
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kinds of attack or monitoring by law enforcement. Traffic routed through the Tor network can be slow 
since it makes six hops or relays from the user’s computer to the cryptomarket. These hops are random 
throughout the worldwide Tor network, making it difficult to discern the nationality or location of either 
buyer or seller. 

Cryptomarkets provide drug dealers with a worldwide market for their products and the capacity to sell to 
customers they do not know, to trade anonymously in a relatively low-risk environment (Aldridge & 
Décary-Hétu 2014) with increased personal safety and reduced possibility of violence. There are other 
risks however, such as those associated with technical failure or scams. 

3.1.1. Purchase and feedback 

Cryptomarket users need to create a free account, after which they are able to browse vendor pages to 
compare products (Martin 2014a; Van Slobbe 2016) or access the site forums for information about 
products (Martin 2014a; Van Hout & Bingham 2013b). Figure 3.1 provides a screen shot of an overview 
of drug listings on AlphaBay, one of the largest cryptomarkets. 


Figure 3.1. Screen shot of drug listings on AlphaBay Market 


3 AlphaBay Market 


HOME SALES MES SAGE S ORDERS LISTINGS BALAMCE FEEDBACK FORUMS API SUPPORT 


O Loggcd in as 

Current balance: BTC 0.0000 
Autoshop Log out 


i USD 625.05 * CAD 814 14 *EUR5«8.42 »AUD843.80 » G3P 474.0S 



Search Results 


0 BROWSE CATEGORIES 

► 0 Fraud 

[yl Drugs & Chemicals 
0 Benzol 

O Cannabis & Hashish 
Ooissoastivas 
0 Ecstasy 
O Opioids 

O Presaription 

Bsteroids 
□ stlmulants 
0Tobaooo 
0 Welght Loss 
0 Other 
0Parsphernalia 
0 Psychedelica 

► Q Ouides & Tutoriah 

► 0 Counterfeit Items 


Search Results [Save search) 


22154 

114508 

8871 

3««3 

2533 

17949 

9485 

5390 

3513 

19109 

345 


8413 

9142 


■ [FE 100%) [Sticky] 1G MDMA -Crystals~ Pure qualitiy FAST SHIPPING 
tem# 118324- Ecstasy /MDMA (3097) 


Views: 77581 / Bids: Flxed price 
Quantity lelt: Unlimited 




is 1010 ** 1G * PURE QUALITY PERUVIAN COCAÏNE * UK TO UK * The HONEST Cocaine 


■ (MS) (Sticky) ** FERRAGAMO Baten amvec 8TH Ji 
Company * FAST DELIVERY ** 

Item * 125502 • Stimulants ' Cocaine • 

Views: 50731 1 Bids: Fixeo prioe 
Quantity left Unlimited 


■ (MS) (FE 100%) (Sticky) ORANGE BUO" AA* INDOOR GROWN QPi112G>;S550) Orange Bud AA* INOOOR GROWN 
# 55497 • Cannabis & Hashish / Buds & Floweo (2213) 


J Views: 210500 Bids: Fixed prioe 
Quantity lelt Unlimited 


■ (MS) (Sticky) FBs MED WEED - Northern Lights l9 10) & OGxHindu !8 510) [7 GRAMS; “PREE SHIPPING TO USA“ 
• 12192 - Cannabis & Hashish / Buds & Flowers • (2579) 


] Views: 133794 Bids: Fixi 
Quantitv telt: Unlimited 


NOTE: As of 27 June 2016. Vendor aliases are removed. 

Buyers can place an order with an online vendor and receive the drugs by mail package (Lavorgna 2016; 
Van Slobbe 2016). In order to counter law enforcement efforts, cryptomarket discussion forums and seller 
Q&A pages advise buyers to use pseudonyms and have purchases delivered to addresses other than their 
home (Martin 2014b). 

After receiving their purchase, buyers can leave feedback for the vendor to indicate whether rhe product 
and the service met expectations (Van Slobbe 2016). Cryptomarkets such as Silk Road and Agora (a 
marketplace established in December 2013 and closed in August 2015) featured a feedback system that 


22 







Internet-facilitated drugs trade 


RAND Europe 


allowed buyers to review vendors and their products, similar to business-to-customer e-commerce sites 
such as Amazon or eBay (Aldridge & Décary-Hétu 2014; Tzanetakis et al. 2016). Indeed, buyers are 
expected to leave feedback on their experiences with vendors, so that any scammers can be discovered and 
removed from the market (Aldridge & Décary-Hétu 2014) Potential buyers can use feedback on previous 
transactions and vendor and product scores to evaluate the likelihood that they are purchasing their 
desired product from a trusted vendor (Van Hout & Bingham 2013b, as cited in Aldridge and & Décary- 
Hétu, 2016b). 

These and other ‘marketplace regulation’ mechanisms (Aldridge et al. 2016; Morselli et al. under review) 
combine to facilitate trust between anonymous transactors in the absence of face-to-face strategies 
(Tzanetakis et al. 2016). This can have advantages for both buyers and vendors, for example, because it 
may make violence as an enforcement mechanism less likely. However, it also means that there are risks 
associated with entrusting merchandise or cryptocurrency to trade partners (Tzanetakis et al. 2016). 
Finally, as in the offline world, there is always a risk that a buyer of particular goods or services is actually 
an undercover police officer (Van Slobbe 2016, 79). More information on the role of trust is included in 
Section 6.3.3. 

3.1.2. Payment 

Customers of cryptomarkets tend to pay for products and services with decentralised and 
cryptocurrencies. Their popularity in Online drug marketplaces is due to their secure, anonymous and 
decentralised architecture. As a virtual asset, rather than traditional printed units of fiat money, 
cryptocurrency cannot be destroyed or lost completely and new units are impossible to create. When 
vendors use cryptocurrencies, such as Bitcoins, on cryptomarkets and subsequently launder them with 
exchangers, this makes it difficult for law enforcement to tracé illegal transactions. 13 

Several authors have described the payment mechanisms for purchasing drugs on cryptomarkets (e.g. 
Aldridge & Décary-Hétu 2014; Christin 2013; Soska & Christin 2015; Tzanetakis et al. 2016; Van Hout 
& Bingham 2013a). On Silk Road, only Bitcoin was supported as a payment currency. Bitcoins are not 
issued by any government, bank or organisation, and can be purchased in person or through Online 
exchanges such as CoinBase. Bitcoins are very volatile, which means that prices of listings are dependent 
on their actual exchange rate. In June 2016, a bitcoin was worth $538 (or €480), up from $0.83 in March 
2011 and $133 in October 2013, when Silk Road 1.0 shut down (bitcoinhelp.net 2016). 14 

When a buyer wants to make a purchase on a cryptomarket, upfront payment is required. The funds are 
typically held in deposit, also called ‘in escrow’, by the cryptomarket, thereby allowing the market 
operator to accurately calculate their commission fees. The escrow system also ensures that any disputes 
between buyers and vendors could be resolved by the cryptomarket administrators (Aldridge & Décary- 
Hétu 2014; Christin 2013). Payment is only released to the vendor when the buyer fmalised the sale by 
indicating that the product had been delivered. 


13 There is an ongoing debate as to whether cryptocurrencies should be labelled as currencies, because of their 
extreme volatility in recent years. A requirement for a currency is their relatively stable value. 

14 This means that Bitcoin exchange rates need to be taken into account estimating revenues on cryptomarkets. 
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Similar to the offline world, there are potential risks of third parties stealing the crypto currency held in 
escrow. This has happened in the case of the so-called ‘Evolution exit scam’, in which the site's 
administrators suddenly took their market offline and stole users' currency kept in their escrow accounts 
(Woolf 2015). Multi-signature escrow, a cryptographic tooi that is now offered on some cryptomarkets 
(see also Section 3.2), avoids some of the scam risks for both vendor and buyer associated with centralised 
escrow. 

Sellers with a certain number of successful transactions (in case of Silk Road, it was 35) can request that 
buyers fmalise purchases before the products had arrived (Christin 2013). This practice, marked with TE’ 
(Finalise Early) in feedbacks ensures that the bitcoins flow directly to the vendor without being held in 
escrow. It was created as a backup measure in times of high concerns for exit scams or law enforcement 
seizure, reducing the risk that vendors and buyers lose the funds held in escrow. The risk of vendor scams 
remains however (LE7). 

Bitcoins have been the dominant cryptocurrency used on cryptomarkets. They also were the only accepted 
form of payment on Agora (Tzanetakis et al. 2016). Elowever, as of August 2015, there were 667 running 
and defunct cryptocurrencies, the most well-known of which were Bitcoin, Litecoin and DarkCoin. 15 . 
DarkCoin was accepted as a form of payment on the Nucleus and Diabolus markets in November 2014 
(Cox 2016b). In addition, there is a wide range of services available on the dark and clear net that can 
facilitate opportunities for money laundering (LEI5). 

Cash may be another possibility. Van Slobbe (2016) refers to a case of a buyer from the United States 
who ordered a series of synthetic drug consignments from a vendor in the Netherlands over the dark web 
paying with cash. The currency was shipped in envelopes to several addresses in the Netherlands and 
subsequently collected by the vendor. Although cryptocurrencies are an obvious means of payment on the 
dark web, apparently they are not a prerequisite. 

3.1.3. Communication 

Communication between vendor and buyer typically takes place through the market’s direct messaging 
system. More recently, users tend to encrypt these messages often using PGP (Tretty Good Privacy’), a 
piece of software that provides end-to-end cryptographic privacy and authentication. 16 

Issues or questions that are relevant to the wider community of cryptomarket users can be shared on the 
cryptomarket forum. Finally, clear net fora, such as Reddit, are also important means of sharing 
information (LE11), such as user information, cryptomarket experience, vendor reliability, drug dosage, 
how a drug works and its effects, combination use, risks, etc. (LE7). 

3.1.4. Rules and regulations 

Cryptomarkets typically have rules pertaining to the types of products and services they allow for sale on 
the marketplace and how transactions should take place. While Silk Road operated several rules, for 


15 Map of Coins, 2015 ‘View the Bitcoin cryptocurrency specifications in detail,’ As of 11 June 2016: 
http://mapofcoins.com/bitcoin 

16 For an explanation of how PGP encryption works, see Cox (2016b). 
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instance relating to feedback systems, escrow, payment mechanisms and dispute adjudication, restrictions 
on what could be sold were comparadvely minimal. According to Christin (2013), the Silk Road sellers’ 
guide prohibited listings that ‘harm or defraud, such as stolen items or info, stolen credit cards, 
counterfeit currency, personal info, assassinations, and weapons of any kind’ (p.2). Listings related to 
paedophilia were also restricted. On the other hand, prescription drugs, narcotics, adult pornography and 
fake identification documents were ‘conspicuously absent’ in the rules (Christin 2013, 2). LE15 17 noted 
that many of the drug markets explicitly state that they will not host Child Sexual Exploitation and Abuse 
(CSEA) material and most have some policy about commodities which cause harm or will defraud 
individuals. 

After reviewing the rules made available in a number of cryptomarkets (AlphaBay, Dream Market, 
Valhalla, ffansa, Python, Acropolis, Tochka, Cryptomarket, Outlaw and Nucleus), we found that rules 
for all marketplaces, in the main, could be understood as seeking to reduce particularly third-party harm 
(also confirmed by LEI5). Nine of the ten marketplaces prohibited particular products and services from 
being listed by vendors for sale (the one that did not may have had rules only accessible for registered 
vendors, and therefore not visible to us). The most common exclusions were child pornography (also 
confirmed by LEI5) and assassination services, banned weapons or particular subsets of weapons (e.g. 
bombs, poisons). LEI 5 noted that apart from the rejection of CSEA material there is a range of responses 
to other commodities. Alphabay will sell weapons and card dumps but other sites will not engage with 
these commodities at all (LEI5). Marketplace administrators usually take down prohibited listings, and in 
some cases vendors placing them have been banned. 

Seven in ten marketplaces listed rules related to transaction and associated security measures. Five 
marketplaces did not allow vendors to request that customers ‘finalize early’ (i.e. circumvent escrow) or 
allowed this only to those ‘approved’ to do so. Two marketplaces stated that too many customer reports of 
vendor scamming would result in a vendor’s account being deactivated. One marketplace (ffansa) 
described systems to prevent marketplace exit scams. Some marketplaces had stated rules against 
blackmailing or ‘doxxing’ customers. Three marketplaces explicitly encouraged participants to use security 
and encryption practices, with one stating that marketplace adjudication would be unavailable to 
participants not employing such practices. 

3.1.5. Shipping of drugs 

Cryptomarkets provide dealers with an opportunity to reach a global customer base, compared to a more 
restricted, local market when dealing in the conventional drug market. The use of postal services is an 
enabler in this process, and this practice of shipping of drugs purchased on cryptomarkets has been 
described in several other publications (e.g. Aldridge & Décary-ffétu 2014; Christin 2013; EMCDDA 
2015a; Kooistra & Trommelen 2014; Lavorgna 2014; 2016; Mounteney, Griffiths et al. 2016a; Van 
ffout & Bingham 2013b). 

Once a transaction on an online marketplace is completed, the vendor ships the drugs to the buyer, 
primarily via conventional postal or parcel services who are, as Tzanetakis et al. (2016) mentioned, not 


17 Unpublished e-mail correspondence, as of 8 April 2016. 
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aware of the contents they are transporting. Buxton and Bingham (2015) described a court case 
exemplifying the potential consequences for parcel services unknowingly involved in shipping drugs. 
FedEx, a shipping company, was charged for money laundering following transportation of drugs without 
prescription from Online pharmacies. The company challenged these charges by indicating that the 
responsibility for tackling this issue does not lie with shipping companies, but with licensing, regulatory 
and law enforcement bodies (Buxton & Bingham 2015). 18 

Christin (2013) listed several ways in which vendors may reduce the risk of detection of their shipped 
parcels. Vendors claim to know what customs authorities are looking out for, and many of these options 
are described and in ‘how-to’ guides made available on cryptomarkets or shared on online fora (LE4). 

One option is for vendors to employ ‘couriers’ instead of going to the post office themselves in person. 
Furthermore, practices that conceal the content of the package, such as vacuum sealing or ‘professional- 
looking’ envelopes with typed destination addresses may reduce the risk of inspection (Christin 2013; 
Basu 2014; Martin 2014b, Mounteney, Griffiths et al. 2016; Tzanetakis et al. 2016; Van Flout & 
Bingham 2013b; Volery 2015; LE4). 19 This might involve an envelope with a DVD case and a logo of an 
online retailer or resembling a bag of coffee beans (LEI) or using fictitious or real third party logos, such 
as Unicef (LE2) 20 . 

Other practices that minimise the risk of detection include only sending small quantities of drugs at a 
time in order to fit into an envelope and including a fake return address (Tzanetakis et al. 2016). Stealth 
packaging practices may be included in vendor pages or mentioned on forums (Tzanetakis et al. 2016; 
Martin 2014b). 

More generally, the EMCDDA (2015a) commented that postal or parcel services are still seen as ‘the 
major bottleneck in the system’ (p. 7) and envelopes or parcels containing drugs could be intercepted by 
customs. 21 Tzanetakis et al. (2016) explained that while privacy of domestic correspondence in general is 
‘a liberty and a basic rule of law’ and as such should not be intercepted, customs have the authority to 
check cross-border items under international drug treaties (p. 9). Thus far, surveillance of outgoing mail 
from the Netherlands has been limited and the risk of interception for domestic shipments appears to be 
low (LE2). But out of concern for their ratings, many vendors appear to be reluctant to send items 
internationally to countries with more stringent law enforcement such as Finland, Australia, the United 
States and Canada (LEI, LE2, LE9, LEI 1, EX4, case file). 


ls Based on information from Forbes.com, the case continues and the trial will take place in June 2016. More 
information at: http://www.forbes.com/sites/wlf/2016/05/10/feds-should-absolutely-positively-abandon-bizarre- 
prosecution-ff-fedex-overnight/#2ef6683a40b2 , as of 11 June 2016. 

19 In their study on clear net UK market places selling ‘legal highs’, Schmidt et al. (2011) found that some websites 
indicated that “discrete packaging” was being used (p. 96). 

20 Analysis of the case files reviewed for this study also commented on practices like stealth packaging and using logos 
from online retailers. 

21 See also Aldridge and Décary-Hétu (2016b) for a description of these risks for both vendors and customers. 
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3.2. Trends in drugs trade via cryptomarkets 

The market for cryptomarkets is relatively concentrated. The figures presented in Chapter 4 show that the 
three largest markets cover about 65 per cent of all listings. This observation is consistent with network 
industries theory, which predicts that due to economies of scale in production (i.e. web design), 
consumption externalities (the utility derived from a user account is based on the total number of listings 
on a cryptomarket, whereas the utility derived from a vendor account is proportional to the total 
population of potential buyers), switching costs and lock-in effects (the costs of operating multiple vendor 
shops on different cryptomarkets) these industries have natural monopolistic characteristics (e.g. Shy 
2001,3—6). This would explain the near monopoly that a well-functioning and trusted cryptomarket such 
as Silk Road 1.0 had until its seizure by the FBI in 2013. 

Alternative marketplaces appeared quickly afterwards competing for market share, such as Silk Road 2.0, 
Pandora, Agora, Hydra, and Evolution. In many cases, these market places, based on a profitable business 
model, were run by a professional team of administrators and moderators (LE9). In November 2014, Silk 
Road 2.0 and a number of smaller market places were taken down as part of Operation Onymous. Soska 
and Christin (2015) show that total sales dipped considerably following the intervention, with users 
shifting to Evolution and Agora. 

Cryptomarkets are not a static phenomenon. They are subject to evolvement due to technological 
innovations or in response to scams or interventions. This section discusses several recent developments 
we observed in the literature or interviews. 

3.2. 1. Increasing distrust 

The success of these markets and their vendors strongly depends on their trustworthiness. Cox (2016a) 
argues that reputation systems used on cryptomarkets have created a form of self-regulation: Vendors who 
sell low-quality products or who provide poor customer service will simply not receive good ratings, 
feedback or reviews, so arguably only those providing high-quality products will survive’ (p.52). But in 
addition to law enforcement intervention, various observers have commented that this trust is gradually 
being undermined following a series of security failures and scams (e.g. Greenberg 2016; LE7, LE2, EX6). 
Some even refer to increasing paranoia (LE9). 

Vendors may scam their customers. But markets have also disappeared following exit scams. Agora ceased 
operation due to security issues in August 2015 (Cox 2015b). In January 2016, following another 
reported marketplace scam, DeepDotWeb (2016b) - a website reporting on news about cryptomarkets - 
stated that it seems like it is ‘the season of small exit scams, previously, a market would wait until it 
reaches a certain size, or accumulated a certain amount of BTC before pulling the plug and diving with 
everyone’s money.’ Recently, the second largest cryptomarket (Nucleus) seemed to have shut down 
unannounced since 13 April 2016, leaving users worried about another exit scam (DeepDotWeb 2016c). 

In an interview with Wired, Nick Weaver (University of California at Berkeley) summarises the situation; 
‘Dark web market admins are learning that “if you’re trustworthy, you stay up for a while, the heat 
increases, and eventually you get nailed by the feds. [...] The most viable exit strategy is to rip and run’ 
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(Greenberg 2016). An interviewee argued that exit scams even seem to have a higher impact on the 
market than law enforcement interventions (LE2). 

The increasing distrust among users of cryptomarkets has gone hand in hand with an ideological decline, 
observers comment. Whereas in the early days of Silk Road many of those involved expressed strong 
libertarian motivations and a firm belief in the harm reduction function of cryptomarkets, several 
interviewees argue that they have been overtaken by commercial interests (EX3, EX13, LE9). Christin 
States that ‘ideologically, it’s very different now. There’s no longer much of a sense of camaraderie’ 
(Greenberg 2016). 

One consequence of the increasing distrust on cryptomarkets has been the need for a risk management 
strategy by vendors and buyers: ‘don’t put all your eggs in one basket’. This would explain the current 
situation with several large market places operating in parallel, despite the natural monopolistic 
characteristics of this network industry. 

3.2.2. Mitigating distrust and avoiding exit scams 

Previous take downs and arrests of vendors and administrators by law enforcement have led to 
substantially increased levels of vigilance among cryptomarket users (e.g. EX6, EX18, LE2, LE7). Whereas 
the (anonymous) users would freely and openly discuss issues on Silk Road forums, these days moderators 
urge them to suspend any unencrypted communication and use PGP-encrypted emails or messaging 
instead. 

Exit scam risk has led to a number of developments that help vendors and buyers reduce their dependence 
on large cryptomarkets. Some vendors who have gained a good reputation on multi-vendor markets have 
started their own shop, cutting out the administrator commission as well as the risk of an exit scam (LEI, 
LE2, LE7, LE9 EX3). DeepDotWeb (20l6d) currently lists 18 of those single-vendor shops that allow 
vendors to deal directly with their customers avoiding the risks associated with third party escrow or the 
need to pay a commission to the cryptomarket administrators. These may experience more difficulties 
finding new customers to maintain or grow market share, and therefore they probably keep a presence on 
large multi-vendor markets as well (LE9). They do not have the critical mass that creates consumer 
externalities in typical network industries. Furthermore, the risk of vendor scams to customers remains. 
Alternatives include smaller scale market places that only allow invited buyers or sellers. Darknet Eleroes 
League, for instance, is a collection of old-time vendors with a good reputation, who were invited to sell 
on this market (LE2). 

A similar approach, described by LEI, to reducing risks is for vendors and buyers to use other virtual or 
offline locations to carry out transactions. This means that vendors can use cryptomarkets to publicise 
their illicit activities, but discuss a possible sale through (encrypted) emails or instant messaging after first 
meeting via the marketplace. The buyer would therefore not be protected by the escrow services and the 
cryptomarket administrators but be offered a cheaper price as the vendor does not have to pay a sales 
commission. In Section 4.8.5 we test whether our data provides any empirical evidence on the prevalence 
of this practice. If such practices are very common, then our scraped cryptomarket data will likely 
underestimate vendors’ revenues generated or facilitated by the Tor network. 
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3.2.3. Technicol innovations 

Vendor and market place scams can be prevented by so-called multi-signature transactions, a 
cryptographic tooi that allows buyers to put bitcoins in an escrow account that requires sign-off from two 
out of three parties — the buyer, the seller, and the site itself — to retrieve the funds (Cox 2016b; 
Greenberg 2016; Mounteney, Griffiths et al. 2016). Unlike the traditional, centralised escrow, it is 
impossible to single-handedly retrieve the funds and disappear. However, some observers have argued that 
it may take some effort to understand the workings of this System, which appears to be hampering the 
wide adoption of multi-signature escrow (e.g. Weaver in Wired 2016; DeepDotWeb 2016e). 

As centralised operations are particularly vulnerable to scam risk and law enforcement intervention, other 
technical innovations allow users to buy and sell products with bitcoin through a peer-to-peer system 
without a central server (Greenberg 2016; Lewman 2016; LE7; EX3; EX18). Based on this peer-to-peer 
system, OpenBazaar started operations in April 2016 after a long period of beta-testing (OpenBazaar.net 
2016). This model complicates law enforcement intervention and disruption, as operation is distributed 
over its users, unless individual pages are taken down. Soska et al. (2016) recently introduced a 
decentralised market place that claims to address some of the short-comings of OpenBazaar. One 
interviewee expected that all cryptomarket activity will eventually shift to such peer-to-peer marketplaces 
within next two years (LE7). Others are more sceptical (e.g. DeepDotWeb 2016e). 

Finally, in efforts aimed at fending off law enforcement, vendors are increasingly innovative. Some have, 
according to one interviewee (LE7), automated the transaction process using ‘bots’ to communicate with 
buyers. This helps vendors to avoid having to write messages (which may be subjected to text mining 
techniques) or deal with personal details. 

3.3. Drugs trade and the clear net 

The EMCDDA (2015) reported that Europe faces new drug problems and challenges, particularly due to 
the rise of the Internet-facilitated drugs trade and an increasing prevalence of new psychoactive substances 
(NPS). This section discusses the role of the clear net, the open part of the Internet, which is indexed by 
search engines. 

3.3.1. NPS web shops 

NPS are not typically not controlled by the international drug conventions, but they may pose a public 
health threat. The EMCDDA signalled the existence of a large number of online shops for NPS in 2013 
in Europe (EMCDDA 2015a). NPS often mimic the effects of existing illegal drugs such as cocaine, 
cannabis, ecstasy or opioids. The legality of NPS can give users the false impression that these are 
authorised by law and therefore safe, when in fact there is considerable variety in their legal status and 
various NPS are forbidden by national legislation (EMCDDA 2015a; EMCDDA 2015b). Since January 
2016, for instance, seven additional NPS substances have been banned and added to the Opium Act 
(Opiumlijst) in the Netherlands (EX3). Elowever, various types of NPS are still legal and can be sold 
online as such, although sites should indicate explicitly that they are not intended for human 
consumption. NPS web shops therefore typically label their merchandise as ‘research Chemicals’ (see for 
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example Figure 3.2 below). Or as stated on ‘research-chemicals-kopen.nl’: ‘[The] designer drugs sold on 
this website are intended for research and forensic applications.’ 


Figure 3.2. Screen shot of a clear net website offering 'research Chemicals' 
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SOURCE: As of 23 June 201 6: http://www.chem.eu 

NPS web shops tend to have a very basic design common to web shops in other sectors, for example, 
offering lOOmg of 2c-d, a psychedelic drug, for €18.00 only for delivery in the Netherlands. 22 Check out 
may proceed via a shopping basket and payment proceeds via bitcoins or bank transfers. Packages will be 
delivered within 24 hours by a regular parcel service. Some vendors even offer same-day delivery services 
by car or motorbike courier, charging premium prices. According to Vardakou et al. (2011, 193), “one 
firm offers a minimum 5g delivery service within 90min to any address in London, 24h a day, at a cost of 
£95”. Online herbal, smart or grow shops, such as Shayana.com may offer mushrooms, grow kits or 
psychedelics. A number of studies have aimed to assess the scale and scope of these NPS web shops 
(discussed in Chapter 4). An expert suggested that some NPS web shops use the front end as a funnel to a 
‘back-shop’ with a broader catalogue that is only accessible to invited customers (EX4). 


3.3.2. Online pharmacies 

In addition to NPS, Internet has also facilitated the sales of prescription drugs in recent years (Scammel & 
Bo 2016). Popular products supplied on the web are sexual performance enhancement products (such as 
Viagra), muscle builders and diet pills, and there have been reports of cancer drugs and stem cells being 
marketed over the Internet. There is a body of literature focusing on online pharmacies, which are beyond 
the scope of this study. 


: See for example: http://research-chemicals-kopen,com/product-categorie/2c-d-kopen , as of 11 June 2016. 


30 















Internet-facilitated drugs trade 


RAND Europe 


3.3.3. Illicit drugs on the clear net 

While most literature analysing practices on the clear net focus on online pharmacies and NPS web shops, 
there is some anecdotal evidence that the clear net is also used for advertising or selling illicit substances. 
Interviewees mentioned the existence of several web shops that offered cocaine or cannabis (EX3, LEI), 
using web addresses that suggest other (legal) activities, such as ‘horse auctions’ (paardenveiling.nl). 
Advertisements tend to be only online for a few days, but these websites may exist for multiple years. One 
interviewee indicated that come shops on the clear net sell cutting and bulking agents that can be used for 
illicit drugs trade (EX15). 

Some online sources (e.g. Cox 2015a) also pointed to clear net websites that are offering illicit substances 
including MDMA, methamphetamine, and cocaine, using an Amazon-style web shop look-and-feel and 
requiring payment in bitcoins (e.g. ‘Chemical Love’ and ‘Forbidden Market’). Additionally, the New 
York Times profded sites from China that were shipping illegal narcotics (Levin 2015). For example, on 
‘guidechem.com’, more than 150 Chinese companies sell alpha-PVP, a stimulant that is illegal in the 
United States and the majority of EU countries. 

We did not, however, identify any studies that systematically analysed the scale of illicit drugs trade via 
clear net markets. 

3.3.4. Apps and social media 

Apps and social media have particularly had a role in communicating about drugs and their use. 
Smartphone apps, such as ‘How to sell weed’ or ‘Leafy App’ offer instructions about how to produce, sell 
and buy drugs (EMCDDA 2015a), or YouTube, which is used to communicate about drug use methods 
(e.g. Krauss et al. 2015). Cavazos-Rehg et al. (2014) analysed a pro-cannabis Twitter handle with 
approximately 1 million, overwhelmingly young, male followers. Websites and apps can have an indirect 
role by using marketing to share experience and opinions about different types of drugs, but more 
directly, they connect potential buyers and vendors. 

Particularly, social media such as Twitter, Facebook, Tinder (LE16) and Instagram as well as online fora 
(in particular Reddit), are reported to be used to bring vendors and potential buyers together (e.g. Daily 
Pakistan 2015; Drugabuse.com undated; Michaels 2014; Phelan 2014; The Guardian 2016; LEI 1), or to 
advertise cryptomarkets, including codes to access them (EX10). 

While academie research on this topic is limited, (anecdotal) media reports provide some insights. In the 
case of Instagram and Twitter, the potential customers can use the hashtags system to easily identify 
sellers. By using explicit keywords (hashtags) as ‘#weedforsale’, the name of a specific drug such as 
‘#mdma’, or other code terms, the potential buyer can directly connect to a seller and contact him 
through direct messaging services such as Whatsapp or Kik. Different modalities of payment, including 
Bitcoins, and delivery are then possible. This practice had been observed already in 2013, when Instagram 
blocked searches for certain terms associated with the suspected illegal sale of drugs via its service (BBC 
2013). A law enforcement official discussed instances in which Facebook was used by vendors to advertise 
their drugs, both through using encrypted messenger but also by using their own names (LE16). In the 
case of Tinder, the dating app that facilitates the meeting of people in the same geographical area, The 
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Guardian (2016) recently reported that potential customers can simply swipe through profiles until they 
find a drug dealer in their area. 

The use of social media for illegal purchasing has been documented in the case of illegal access to drugs of 
abuse via online pharmacies. Mackey and Liang (2013) posted a fictitious advertisement of no- 
prescription drugs 23 online to social media platforms (i.e., Facebook, Twitter, Google+, and MySpace), 
and demonstrated that there are few barriers to social media-based illicit online drug marketing. Katsuki 
et al. (2015) established an empirical link between Twitter content and illicit online pharmacies that 
promote the illegal sale of prescription drugs that have significant abuse potential. The study also 
identifies Twitter as a potential source for information, illegally promoting the sale of controlled 
prescription drugs directly to consumers. 


23 The marketing and sale of prescription drugs as ‘no prescription necessary’. 
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4. The size and shape of Internet-facilitated drugs trade 


This chapter primarily addresses research questions focussed on the scale and scope of Internet-facilitated 
drugs trade (research questions’ clusters A, B, and partially C, see Table 1.1). As described in Chapter 2, 
our analysis in this section (and throughout the study) largely focuses on cryptomarkets, with some 
information collected about ‘clear net’ web shops selling legal psychoactive substances. In relation to the 
latter, information was collected through a review of the limited literature on clear net sales (which 
primarily relates to the relatively large number of single vendor-type web shops identified within Europe). 

In relation to the former, the analysis is based on a review of the literature that has emerged in recent years 
(including academie literature, grey literature, and importantly in this area, work by journalists and 
independent researchers) as well as the new empirical data collected for this study. We contribute to this 
literature connected to our own empirical investigation of data collected for this project: data scraped in 
January 2016 from eight of the largest cryptomarkets, including 105,811 listings placed by 3,846 vendors 
worldwide (see Chapter 3 Methodology). The resulting dataset is, to our knowledge, the most up-to-date 
and comprehensive at this juncture. We complement this marketplace data and information from the 
literature with insights from expert interviews. 

Our analyses aim to characterise these marketplaces in terms of substances sold by the vendors who place 
listings for sale on cryptomarkets. We were also able, by examining volume of trade (transactions and 
revenues generated), to generate understanding of which categories of drug are most important on these 
marketplaces, and the extent to which cryptomarkets may be serving a ‘wholesale’ function for customers 
sourcing stock for redistribution. We examined changes in connection to all these analyses by comparing 
our multiple market results - which we estimated to represent about 80 per cent of total cryptomarket 
listings in January 2016 - to an analysis conducted on the first and at the time only major drug 
cryptomarket, Silk Road 1.0, shut down by the FBI in September 2013. To this end we used data 
collected in the few weeks before its closure to examine trends. We present results for all our analyses for 
vendors worldwide, but also for those separately for vendors indicating they ship drugs from the 
Netherlands, most of whom we believe are likely to have a base of operations in this country. Finally, we 
examined sales of products and services that are not drugs themselves, but some of which are drug-related 
(e.g. lab equipment, paraphernalia) or services that may support those involved in drug supply activity 
(e.g. money laundering). 
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4.1. Previous studies reporting on the size and shape of Internet- 
facilitated drugs trade 

Several studies provide quantitative analyses of drug markets on the dark and clear net with varying 
methods, aims and scope and time periods covered. 

For example, methods applied range from conducting primary research by using a bespoke data crawler to 
systematically index cryptomarkets (e.g. Aldridge & Décary-Hétu 2014; Christin 2013; Soska & Christin 
2015), systematically conducting searches in search engines to identify and analyse clear net markets (the 
‘snapshot’ methodology as used by e.g. Martinez et al. 2016), or creating a user profile on the dark net to 
monitor these markets (Van Buskirk et al. 2014) to do secondary research in which other, existing data 
sources were used (e.g. Bartlett 2015; Ciancaglini et al. 2015). 

These studies differed in their clarity or transparency of the methods applied. In the study by Ciancaglini 
et al. (2015), for example, cryptomarket data were used that were collected from a specific website, 
without further explaining how these data were originally collected or what markets were included in ‘all 
marketplaces’ (p. 10). Phelps and Watt (2014) did not elaborate on the specifics and potential caveats in 
monitoring users of Silk Road, and did not explain the criteria used for selecting a group of Australia- 
based vendors. And Dolliver’s (2015) analysis of Silk Road 2.0 data has been criticised by various authors 
(see Aldridge & Décary-Hétu 2015b; Buskirk et al. 2015; Munksgaard et al. 2016; Soska and Christin, 
2015) because its main conclusion was that the marketplace was used most and foremost to sell eBooks. 
Serious doubts have been raised about the accuracy of Dolliver’s data collection given this finding that is 
at odds with all other research. 

The identified studies also differed in terms of aims and scope: some studies, in particular the studies on 
the clear net market, did not aim to examine the full market, but only looked at a particular type of drugs 
(e.g. Nizar et al., 2015) or a market for a specific country (e.g. Kooistra & Trommelen 2014 who looked 
at the Dutch market). This caveat affects the extent to which statements concerning size of the online 
drug market can be made. 

Finally, the studies were conducted at different points in time: from the identification of clear net websites 
offering ‘the possibility to purchase drug-related items’ in 2003 (Schifano et al. 2006, 643) to long-term 
analyses of cryptomarkets between 2013 and 2015 (Soska & Christin 2015). 

These studies and relevant fmdings are presented in Table Cl (cryptomarkets) and Table C2 (clear net) of 
Appendix C for further reference, and used as individual examples throughout this report where relevant. 

As several clear net studies applied the so-called ‘snapshot methodology’, a description of this 
methodology is discussed in more detail in Box 4.1. 
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Box 4.1. The snapshot methodology 


The Psychonaut 2002 EU project used a so-called 'snapshot' methodology to monitor drug-related content on the 
Internet (Schifano et al. 2006). Specific enquiries were entered in Google and AltaVista, which resulted in a 'time- 
specific picture of the existing websites' (Martinez et al. 2016, 97; Schifanoet al. 2006). This methodology was 
further developed by the EMCDDA, who published several articles with updated snapshot findings of Online shops 
in Europe selling NPS, with the most recent snapshot identifying 651 Online shops in 2013 (see Table C2 in 
Appendix C for a full overview of EMCDDA findings and study details) (EMCDDA 2015a). The European 
Commission funded researchers from five countries (Czech Republic, France, the Netherlands, Poland and the 
United Kingdom) to develop this snapshot methodology further under a project called 'l-TREND' (Internet Tools for 
Research in Europe on New Drugs) (Martinez et al. 2016). As described by Martinez et al. (2016), the project 
'aimed, among other things, to develop a software-automated tooi for monitoring Online shops using a less resource 
intensive method than had been available previously' (p. 97). In sum, this methodology can be best understood as 
a repeated cross-sectional study design, in which the types of substances and search engines used can vary over 
time. 


4.2. The number and size of online marketplaces for drugs 

Only a few years ago, Silk Road had virtual a monopoly on the dark web; it was the first cryptomarket 
dedicated primarily to the sale of illicit drugs. The market quickly gained popularity and ran successfully 
for about two and a half years until it was shut down by the FBI in October 2013. By that time several 
rival marketplaces had appeared. Silk Road 2.0 (SR2) was launched only weeks after the closure of its 
name saké. Throughout 2014, several other markets opened with Pandora, Agora, Hydra, and Evolution 
competing with SR2 (Aldridge & Décary-Hétu 2016b). Some markets disappeared again. Most 
prominently, Evolution closed in March 2015 with its administrators reportedly having seized 
$12mworth of bitcoins held in escrow (Woolf 2015). 

Although there was variation in the number of markets analysed and methods used, several studies 
identified in the literature review reported on findings relating to the number of dark and clear net 
markets and their drug listings. Although there were a few primary studies examining (a selection of) 
cryptomarkets and their accompanying listings, the exact number of market places for drugs available on 
the clear net remains unknown. However, a project such as I-TREND aimed to assess the availability of 
online shops selling NPS in particular countries (Martinez et al. 2016). 

4.2.1. Cryptomarkets and their listings 

At the time of publication of this report, there are approximately 50 cryptomarkets and vendor shops on 
the dark web according to the website DeepDotWeb.com. 24 As of mid-February, there were 19 active 
cryptomarkets with at least 400 listings each, either for drugs or non-drug related products (see Table 
4.1). 

As explained in Section 2.3, the dark web crawler used in this study (DATACRYPTO) monitored a total 
of eight cryptomarkets yielding 105,811 listings (for all goods, not just drugs) in mid-January. In addition 
to these eight, Table 4.1 also includes the cryptomarkets that were not monitored by DATACRYPTO. In 
total, these markets reported to have a total of 27,000 listings in their category menus in mid-February. 


24 Online, available at: http://deepdotweb.com , as of 23 June 2016. 
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Taken together, we estimate the total number of listings across all marketplaces therefore to be 133,061, 
suggesting therefore that the January DATACRYPTO scrape on which our results are based captured 80 
per cent of all listings across all cryptomarkets. 25 It is very likely that the total of number of listings on 
cryptomarkets that were not monitored by the DATACRYPTO tooi will actually be lower than the 
estimates we derived using marketplace-generated listing number metrics, because the administrators of 
these cryptomarkets may have an incentive to inflate the advertised number of listings on their market to 
raise the credibility of their cryptomarket. The 80 per cent estimate is therefore a likely underestimate of 
the proportion of all cryptomarkets listings that were analysed in this report. Of course, there is a 
possibility that the 80 per cent of listings we analysed were not representative of all the cryptomarket 
listings but the odds of error are small in this case since the DATACRYPTO tooi analysed old, new, large 
as well as small cryptomarkets. 

Many more cryptomarkets appeared to be active, but they have fewer than 400-500 (self-reported) listings 
or they did not provide enough information for us to ascertain their size and scope. This is often the case 
with cryptomarkets specific to particular regions such as France or Russia. The well-known Russian 
Marketplace (RMP) has been active since 2012. As part of our previous work, we managed to create an 
account and browse the market but could only fmd a small number of vendors offering products with 
little apparent activity. This is not to say that this market was not used by many Russian nationals. But 
the information publicly available on the cryptomarket did not suggest that this is the case. These smaller 
cryptomarkets were not included in Table 4.1 as we only focused on the larger cryptomarkets for this 
report. Observers noted however a growing trend in cryptomarkets towards more geographically localised 
markets and this should be considered in future studies. At the time of writing, the research team could 
not identify any market targeted specifically at Dutch buyers. 

In addition to these multi-vendor cryptomarkets, interviewees reported the emergence of a number of 
single-vendor markets as an important trend (LE2, EX3, LE9). According to DeepDotWeb, there were 18 
single-vendor markets on the dark web in April 2016. 


25 There are reasons to suspect that self-reported metrics from cryptomarkets are inflated, but it was not possible to 
investigate this hypothesis further for this report. Should it be the case that cryptomarket-generated metrics are 
inflated, this would suggest that the 80 per cent of listings we collected for the present analyses is a lower limit: in 
other words, we may have captured an even larger percentage proportion of total listings across all cryptomarkets. 
Even without assuming marketplace inflation of listing numbers, our capture of 80 per cent of listings suggests good 
coverage and representativeness. 
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Table 4.1. Distribution of the listings on active cryptomarkets in January/February 201 6 


Name 

Mo n ito red by 
DATACRYPTO for this 
study 

Date of creation 

Number of listings 

AlphaBay 

Yes 

2014/12/22 

37,896 

Cryptomarket 

Yes 

2014/12/22 

8,362 

Dark Net Heroes League 

Yes 

2015/05/27 

387 

Dreammarket 

Yes 

2013/11/13 

22,284 

French Dark Net 

Yes 

Unknown 

1,307 

Hansa 

Yes 

2015/07/18 

4,829 

Nucleus 3 

Yes 

2014/10/24 

26,538 

Python 

Yes 

2015/07/10 

4,208 

Sub-total 



105,811 

Valhalla (Silkkitie) 

No 

2013-10-01 

11,000 

Dr. D's Market 

No 

2015-02-20 

4,000 

German-Plaza 

No 

2015-04-01 

3,700 

Outlaw Market 

No 

2013-12-29 

2,000 

TheRealDeal 

No 

2015-03-31 

2,000 

Oasis Market 

No 

2015-12-20 

2,000 

Acropolis Market 

No 

2015-11-06 

700 

Tochka 

No 

2014-01-30 

500 

Aflao Market 

No 

Unknown 

500 

Dark Rabbit 

No 

Unknown 

450 

Bloomsfield 

No 

2015-12-24 

400 

Sub-total 



27,250 

TOTAL 



133,061 


NOTE: 


3 Nucleus, in February 2016 the second largest market after AlphaBay, seemed to have shut down since the 1 3th 
of April (DeepDotWeb, 2016). 

With regard to the literature on cryptomarkets and their listings, most of the studies based on primary 
research found that the majority of listings on the dark web are related to drug items. Between 2011 and 
2012, Christin (2013) crawled Silk Road 1.0 for eight months, in which he identified 24,400 unique 
items (not just drug listings). The main categories are related to narcotics or controlled substances of 
which cannabis appeared to be most popular category with 3,338 items available (13.7 per cent of all 
items). In their long-term analysis of 16 cryptomarkets between 2013 and 2015 (excluding those with 
volumes of <$1,000 or those that could not be observed), Soska and Christin (2015) identified a total of 
78,509 item listings (all listings, not just drugs) with valid observations. Aldridge and Décary-Hétu 
(2014), who analysed Silk Road 1.0 in September 2013, identified 11,904 active listings related to drugs 
(11,853 relevant listings included for analysis), with prescription drugs (3,953) and cannabis (2,661) 
accounting for most of the drugs listings, followed by psychedelics (1,539), stimulants (1,274), ecstasy 
(1,059) and opioids (262). In contrast, one study based on crawling Silk Road 2.0 between August and 
September 2014 estimated this market to be less drug-focused (348 out of 1,834 items were drug items) 
(Dolliver 2015). However, the fmdings from this study should be treated with caution, as some authors 
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suggested that the data collection may have resulted in only a partial dataset (e.g. Aldridge & Décary- 
Hétu 2015b; Buskirk et al. 2015; Munksgaard et al. 2016; Soska & Christin 2015), therefore generating 
potentially misleading results. 

4.2.2. Clear net markets and their listings 

We did not identify any studies that aimed to estimate NPS revenues on the clear net market. However, 
studies did report on the number of online web shops for selected NPS or countries (e.g. Bigdeli et al. 
2013; Corazza et al. 2014; EMCDDA 2009; 2011a; 2011b; Hillebrand et al. 2010; Lahaie et al. 2013; 
Martinez et al. 2016; Nizar et al. 2015; Schmidt et al. 2011; Van Buskirk et al. 2013; 2014). Hillebrand 
et al. (2010), for example, found 69 online shops in the EU in 2008. As mentioned in Box 4.1, the 
EMCDDA identified 651 online shops in Europe selling and shipping NPS to EU Member States in 
2013 (EMCDDA & Europol 2013). In comparison, this was 314 in 2011 (EMCDDA 2011a). Although 
looking at five countries in particular (Czech Republic, France, the Netherlands, Poland and the United 
Kingdom), project I-TREND identified 584 online shops between 2013 and 2014. 

4.3. Types of drugs offered via Internet 

Access to illegal drugs globally varies considerably in spite of globalising processes, with availability 
connected to international economie relationships between and among countries (e.g. the ‘Global South’ 
versus the ‘Global North’) and in connection to available shipping routes and proximity to the production 
countries (Boivin 2014). This section will focus how cryptomarkets facilitate the trade of different types of 
illicit drugs. 

4.3.1. Cryptomarkets 

Table 4.2 presents the share of listings for each drug type at the international level and for listings likely to 
be held by vendors based in the Netherlands. However, not all listings generate sales (across all these 
markets, only 20 per cent of listings had generated a sale in the previous month). Counting listings must 
therefore be understood as telling only a very limited story about what drugs are available for purchase on 
cryptomarkets; counting listings does not teil us which drugs are actually sold. We attempt to describe the 
drugs actually sold in subsequent sections of this report. 

Proportion of listings that are for drugs 

Our results (Table 4.2) show that about 57 per cent (60,337) of scraped listings offered drugs on the eight 
included cryptomarkets in January 2016. The absolute number of drug listings has therefore increased 
about six-fold, compared to data collected by Aldridge and Décary-Hétu (2014) from Silk Road 1.0 in 
September 2013. Observers noted that the proportion of non-drug listings have increased since then. This 
is an important change, since drug listings represented the vast majority of listings on Silk Road. Our data 
do not allow us to ascertain the reason for cryptomarkets now including more non-drug sales of goods and 
services, but it may be that worldwide media, law enforcement and policy attention drawn to 
cryptomarkets allowed vendors of these non-drug products and services to see potential in these platforms. 
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Types of drugs offered 

We grouped all drugs listings, based on the categories provided in Appendix A. Cannabis listings were 
most common across all drug listings on the eight markets (30 % of all drug listings). Prescription drugs 
(24 per cent), ecstasy (17 per cent), stimulants (13 per cent) and psychedelics (11 per cent) follow in 
descending order. Non-prescription opioids (e.g. heroin) made up 3 per cent of drug listings, with listings 
for alcohol and tobacco (< 1 per cent) relatively infrequent. Taken together (cannabis, ecstasy, 
psychedelics) there is a predominance of drugs typically associated with recreational or ‘party’ use, 
although some categories include substances associated with dependence (e.g. oxycodone within the 
‘prescription’ category; methamphetamine in the ‘stimulants’ category, and heroin in the ‘opioids’ 
category. Several interviewees confirmed the predominance of recreational drugs available on 
cryptomarkets (e.g. EX4, EX6, EX15, EX18). 


Table 4.2. Categories of drug listing for sale ('All' and 'Dutch' only drug listings) 


ALL DRUG LISTINGS 

DUTCH DRUG LISTINGS 

N % 

N % 

Alcohol + tobacco 

70 

<1% 

0 

0% 

Cannabis 

18,369 

30% 

986 

15% 

Ecstasy type 

9,972 

17% 

2,725 

42% 

Prescription 

14,511 

24% 

365 

6% 

Psychedelics 

6,622 

11% 

915 

14% 

Stimulants 

7,852 

13% 

1,328 

20% 

Opioids 

1,979 

3% 

172 

3% 

Other drugs 

962 

2% 

47 

1% 

Total 

60,337 

100% 

6,538 

100% 


Literature and interview responses appear to corroborate most of our fmdings in relation to the type of 
drugs sold and their relative proportions, and provide some context and explanation (e.g. EX4, EX3, EX6, 
LE15). Van Buskirk et al. (2013; 2014), for instance, who looked at the number of retailers selling 
substances to Australia, found that between 2012 and 2013, cannabis, NPS and MDMA were the most 
commonly available on Silk Road 1.0 (Van Buskirk et al. 2013) and cannabis, pharmaceuticals and 
MDMA most commonly available on Agora, Evolution, Silk Road 2.0, Pandora and Cloud Nine between 
July and December 2014 (Van Buskirk et al. 2014). EX4 suggested that the substance types available 
Online mirror consumption patterns offline, with our results confirming that the substances most likely to 
be available on cryptomarkets are also those with the highest prevalence of use, at least in the countries of 
the Global North (primarily Europe and North America), in particular cannabis and ecstasy, followed by 
cocaine and methamphetamine. 

While, according to the EMCDDA, heroin still constitutes the second largest illicit drug market (after 
cannabis) in the EU with a retail value estimated between €6.0 and €7.8bn, most experts concur that its 
market share on cryptomarkets is relatively small. EX3 and LEI4 suggested a reason that substances like 
heroin may be less often sold on cryptomarkets could be due to the fact that buying on cryptomarkets 
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requires an element of planning; this may not suit the daily use of dependent users, particularly those with 
chaotic lifestyles. Nevertheless, heroin listings alone amounted to 2.7 per cent of all drug listings. 

While clear net markets tend to be dominated by NPS, some interviewees (e.g. EX12) concurred that they 
play a much smaller role on cryptomarkets. 

Types of drugs listings by Dutch vendors 

We undertook an analysis looking at the types of drugs offered by ‘Dutch Vendors’, and found that the 
distribution across drug categories was markedly different compared to vendors not categorised as 
‘Dutch’. A majority of listings were for ecstasy-type drugs (42 per cent), followed by non-prescription 
stimulants (20 per cent). Similar percentages of listings were found for cannabis (15 per cent) and 
psychedelic drugs (14 per cent), with listings for prescription drugs (6 per cent) were relatively infrequent 
compared to the overall picture. 

Several interviewees were also of the view that the drugs offered for sale by Dutch vendors were different 
(e.g. LE2). The divergent picture for the Netherlands (likely also the case for other individual countries) 
reflects a complex interplay of variables, including legal context, differing ‘tolerance’ for drug use, and 
location in relation to drug production and trafficking. These observed differences may be explained by 
longstanding policies of tolerance towards ‘soft drugs’ (a point also noted by LE2)7 combined with the 
fact that much MDMA is manufactured in the Netherlands, alongside the country’s importance to drug 
trafficking operations connected to its shipping ports. 

Retail versus Wholesale 

We note also that buyers on cryptomarkets may not always be purchasing for personal use, with some 
customers sourcing stock Online for offline distribution (Aldridge & Décary-Elétu 2016a). We found that 
most listings for heroin (^75 per cent) across the eight markets were priced under $500, with 12 per cent 
priced over $1,000, which suggests a ‘wholesale’ phenomenon. The rationale for the designation of 
‘wholesale’ as transactions priced over $1,000 is discussed in more detail below. 

We undertook an analysis looking at the types of drugs offered by ‘Dutch Vendors’, and found that the 
distribution across drug categories was markedly different compared to vendors not reporting to ship from 
the Netherlands. A majority of listings were for ecstasy-type drugs (42 per cent), followed by non- 
prescription stimulants (20 per cent). Similar percentages of listings were found for cannabis (15 per cent) 
and psychedelic drugs (14 per cent), with listings for prescription drugs (6 per cent) relatively infrequent 
compared to the overall picture. 

4.3.2. Clear net markets 

Studies identified in our literature review into web shops selling substances on the clear net, primarily 
looked at the sale of NPS (e.g. EMCDDA 2009; 2011a; 2011b; Elillebrand et al. 2010; Martinez et al. 
2016; Nizar et al. 2015). The details of the types of listings such as those available from studies that 
crawled the dark net were not commonly examined (or reported) for the clear net, with a few exceptions. 


26 


This in spite of recent policy development introducing stricter criteria for coffee shops (e.g. Spapens et al. 2014). 
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Hillebrand et al. (2010), for example, found more than 500 unique items being advertised on 27 selected 
online shops, with salvia divinorum (a psychoactive plant) being listed by the majority of the selected 
websites (74 per cent) between February and June 2008. Between 2012 and 2013, a study monitored 
websites that were willing to ship to Australia and listed the ‘number of retailers selling the ten most 
common EPS’ (‘Emerging Psychoactive Substances’) (Van Buskirk et al. 2013, 5). It was found that 6- 
APB (Benzo Fury), Ethylphenidate and aMT were most popular among retailers willing to ship to 
Australia (Van Buskirk et al. 2013). 

4.4. Revenues of drugs trade 

This section presents the results from our primary data collection on cryptomarkets and summarises the 
literature on both dark and clear net. Several studies have signalled the role of the Internet in facilitating 
drugs trade. As explained below and in our methodological description, it is more difficult to assess drug 
revenues for clear net market places than for cryptomarkets. Clear net sites tend to have a relatively short 
time span. And estimating the quantities of drugs traded is more difficult for websites that do not collect 
and publish information about transactions (c.f. feedback on cryptomarkets). Furthermore, and as 
explained elsewhere in this report, most studies examining the clear net were not primarily aimed to assess 
the size of Internet-facilitated drugs trade. As such, there were no studies identified that estimate revenues 
of clear net web shops. 27 

4.4. 7. Cryptomarkets 
Total revenues 

We measured revenues or turnover that drug vendors generate by selling on these marketplaces (we did 
not measure profits; see Section 2.3.2.3 for how we measured revenue) for eight cryptomarkets monitored 
by DATACRYPTO. Analysis of these markets suggests a total monthly revenue of $l4.2m (€12.6m) for 
all drugs listings and $12.0 million (€10.6m) when prescription drugs and alcohol and tobacco are 
excluded (see Table 4.3). As explained in Section 2.3, this will likely be an underestimate of the total 
revenues of drugs trade via cryptomarkets, as these estimates are based on customer feedbacks for eight of 
the largest market places. Based on the approach explained in Section 2.3.2.3, an upper-boundary 

estimate for monthly drug revenues on all cryptomarkets would be $25.Om (€22.lm) and $21.lm 

28 

(€18.7m) when prescription drugs and alcohol and tobacco are excluded. - 

Revenues generated by vendors who indicated shipping from the Netherlands amount to $l.lm 
(€977,000) for all drugs listings and $l.lm(€962,000) when prescription drugs and alcohol and tobacco 


27 There was one study that referred to an operation conducted by the US Drug Enforcement Administration in 
2004, which found that some vendors of hallucinogens online had sales of up to $20,000 per week (Schifano et al. 
2006). 

28 

This upper-boundary estimate does not include revenues via potential stealth listings (see Section 2.3.2.8), nor 
does it compensate any potential seasonal effects (see Section 2.3.2.3), as there is no information about these 
phenomena to draw any meaningful assumptions. 
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are excluded (see Table 4.3). These figures represent 8.9 per cent and 9.1 per cent of the total 
cryptomarket revenues respectively. 

When trying to extrapolate these results to an annual revenue figure, one needs to take into account that 
the period between mid-December and mid-January (the window of measurement) is not necessarily 
representative in terms of substance consumption for the rest of the year. For these reasons (and other) it 
is difficult to provide an estimate of the scale of online trade vis-a-vis offline trade. Aside from the 
methodological issues related to estimating cryptomarket drugs revenues (see section 2.3.2.2), one will 
need to separate Wholesale transaction from retail to avoid doublé counting. 

Notwithstanding the aforementioned limitations, differences in the order of magnitude between our 
results and those generated for the total retail value of drug markets suggested that the drugs revenues on 
cryptomarkets are relatively small compared to offline trade. Acknowledging a range of caveats, the 
EMCDDA and Europol (2016) estimate that the 2013 EU retail drug market is estimated to be worth at 
least €24bna year (i.e. €2bn on average per month). While our estimates for cryptomarkets refer to 
international drugs trade revenues (as opposed to EU alone), they still deviate by a factor of about 200. 
This was echoed by one expert who believed that the scale of the phenomenon (i.e. drugs trade facilitated 
by the Internet) has been overstated, whereas in fact its actual share in drugs trade is relatively small 
(EX3). 

Looking just at ‘Dutch Vendors’ our analysis of the eight markets found that the total drugs revenues for 
‘Dutch vendors’ were around €lmper month (Table 4.3). For comparison, Dutch coffeeshops were 
recently estimated to generate an average monthly revenue in the range of €70-100mfor cannabis alone 
(Bieleman et al. 2015). Further, the scale of money laundering in the Netherlands is estimated at around 
€1.35bn per month (Korps landelijke politiediensten, KLPD 2013). On the other hand, it becomes clear 
that the Netherlands’ pivotal role in production of synthetic drugs offline is replicated online. 

Other researchers studying drug cryptomarkets have also attempted to measure revenues. As can be found 
in Table Cl of Appendix C, only a limited number of studies identified in the literature review provided 
an estimate of total revenues of cryptomarkets based on primary research (Aldridge & Décary-Flétu 2014; 
2016a; Christin 2013; Kooistra & Trommelen 2014; Soska & Christin 2015). There were a few instances 
where an estimate was provided for a selection of vendors based on secondary data (Barrett 2015), or 
where the methods used were not clearly defined (Buxton & Bingham 2015). 

Christin (2013), based on data collected between 2011-2012, estimated the revenue for both drug and 
non-drug related listings on Silk Road 1.0 to be a total of around $15m annually. One year on (2013), 
Aldridge and Décary-Flétu (2014) estimated the total revenue of Silk Road 1.0 (drug listings only) to be 
$89.7m annually at the end of 2013 - an increase on the Christin’s estimate from 2013. Soska and 
Chrisin (2015), in their long-term measurement analysis of several cryptomarkets, calculated that 
revenues on Silk Road 1.0 (across the marketplace, not just drugs) were around $300,000 per day in the 
summer of 2013, translating to over $100m annually. Across seven markets for which they calculated 
revenues, the daily revenues for all goods sold were in the $550,000 to $650,000 range (Soska & Christin 
2015). With regard to the Dutch share on these markets, (for all listings, not just drugs) Kooistra and 
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Albeit primarily in the Anglo-Saxon world and Western Europe. 
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Trommelen (2014) estimated this on Agora to be 12 per cent (of €81m total revenue) and 7 per cent on 
Silk Road 2.0 (of €64m total revenue) in 2014. Evidence therefore indicates steady and substantial 
increases in drug revenues on cryptomarkets over time, and similar increases are found for Dutch vendors. 

Revenues by type of drug 

As indicated in Cl in Appendix C, Aldridge and Décary-Hétu (2014; 2016a) reported on revenues on 
cryptomarkets by type of drugs. The authors found that cannabis generated the largest amount of revenue 
(compared to other drugs) on a monthly basis ($2,038,213), with ecstasy and stimulants generating 
$1,613,840 and $1,330,989 respectively (Aldridge & Décary-Hétu 2016a). 

Although not calculating the revenues per type of drug, Soska and Christin (2015) found that at 
equilibrium (i.e. when a market is restored after an event like a large scam) and across all markets 
analysed, cannabis and MDMA each accounted for roughly 25 per cent of revenues. This was 20% for 
stimulants and just under 10 per cent each for psychedelics, opioids and prescription drugs (Soska & 
Christin 2015). 

Kooistra and Trommelen (2014) found that most revenues to ‘Dutch vendors’ were generated by ecstasy 
(29 per cent) and cannabis (27.5 per cent) across four cryptomarkets (see Table Cl in Appendix C for 
other categories). 

When looking at the size of trade for individual drug types, again we saw a different picture emerging 
when examining actual sales compared to counting listings for drugs on the eight markets. For example, 
only 13 per cent of the listings were in the ‘stimulant’ category (see Table 4.2), but these generated nearly 
a quarter (24 per cent) of all the drugs monthly revenue. By contrast, listings in the prescription drug 
category accounted for nearly a quarter of all drug listings (Table 4.3), but generated only 15 per cent of 
all drug revenue. This demonstrates the importance of revenue analysis when attempting to understand 
drug selling activity on cryptomarkets. 


Table 4.3. Sales (estimated monthly transactions and revenue) across drug categories ('All' and 
'Dutch' only drug listings) 



ALL DRUG LISTINGS 



DUTCH DRUG LISTINGS 

Transactions 
in last month 

% 

Revenues in 
last month 

% 

Transactions 
in last month 

% 

Revenues in 
last month 

% 

Cannabis 

30,790 

33% 

$4,436,803 

31% 

1,289 

17% 

$103,376 

9% 

Stimulants 

17,206 

18% 

$3,461,023 

24% 

2,135 

29% 

$276,498 

25% 

Ecstasy-type 

11,031 

12% 

$2,262,850 

16% 

2,188 

29% 

$527,541 

48% 

Prescription 

17,984 

19% 

$2,185,147 

15% 

371 

5% 

$17,436 

2% 

Psychedelics 

9,993 

11% 

$1,020,059 

7% 

1,054 

14% 

$115,446 

10% 

Opioids 

5,241 

6% 

$751,021 

5% 

422 

6% 

$59,686 

5% 

Other drugs 

465 

<1% 

$71,457 

1% 

30 

<1% 

$4,079 

<1% 

Alcohol+tobacco 

63 

<1% 

$2,683 

<1% 

0 

0% 

$0 

0% 

Total 

92,774 

100% 

$14,194,043 

100% 

7,488 

100% 

$1,104,063 

100% 
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Cannabis produced (31 per cent) of drugs revenue across all drug listings (and 37 per cent when alcohol, 
tobacco and prescription drugs are excluded), but substantial revenue was also generated in the other drug 
categories. Revenues for stimulants constitute 24 per cent of total revenues (and 29 per cent when alcohol, 
tobacco and prescription drugs are excluded). These patterns are more or less coherent with the total 
market shares of these substances in the EU (EMCDDA 2016a), where the cannabis market makes up 
about 38 per cent of the total retail value and cocaine constitutes 24 per cent (see Table 4.4). The main 
differences can be found in ecstasy and opioids (which includes heroin). Whereas ecstasy-type drugs 
generated 16 per cent cryptomarket revenues (19 per cent when alcohol, tobacco and prescription drugs 
are excluded), they only constitute 3 per cent of the total EU retail value. As discussed above, opioids 
tends to be underrepresented on cryptomarkets with opioids only generating 5 per cent of revenues (6 per 
cent when alcohol, tobacco and prescription drugs are excluded), compared to a total retail market share 
for heroin of 28 per cent in the EU. Sales for alcohol and tobacco were a very small share of drugs 
revenues across the cryptomarkets analysed, likely reflecting the fact that these can be purchased legally, 
albeit with restrictions, in most jurisdictions. 

There are some differences between the shares of transactions and revenues, caused by the average values 
of transactions. Prescription (15 per cent) and ecstasy-type drugs (16 per cent) generated similar 
proportions of revenue, but prescription drugs had proportionately more transactions. Psychedelic drugs 
and opioids also generated substantial monthly transactions and revenue, but in smaller proportions 
compared to the other drug categories. 

Table 4.4. Estimated total minimum retail value of the illicit market for the main drug types in the 
EU (in billions EUR, USD and per cent) 


Drug type 


Retail value 

Market share 

Annual (EUR) 

Average per month (USD) a 


Cocaine 

€5.7bn 

$0.53 bn 

23% 

Heroin 

€6.8bn 

$0.63 bn 

28% 

Amphetamines 

€1.8bn 

$0.17 bn 

7% 

Cannabis 

€9.3bn 

$0.87 bn 

38% 

Ecstasy 

€0.7bn 

$0.07 bn 

3% 

Total 

€24.3bn 

$2.3 bn 

100% 


NOTE: The drug categories used by EMCDDA deviate slightly from those identified by DATACRYPTO. Cocaine 
and amphetamines are in our 'stimulants' category, and heroin is in our opiates category. Monthly USD estimates 
are based on an exchange rate EUR/USD of 1.14 
a Based on an exchange rate EUR/USD of 1.14 
SOURCE: EMCDDA (2016a) 

Revenues by type of drug for vendors shipping from the Netherlands 

The market shares of different drug types are markedly different for ‘Dutch vendors’. Our revenue 
analysis demonstrated concentration primarily in two drug categories that the listing count did not reflect. 
Ecstasy-type drugs generated nearly half (48 per cent) the overall revenue generated by Dutch listings 
(compared to 16 per cent for all vendors), with stimulants generating another quarter of monthly drug 
revenues for these vendors. Roughly 9 per cent of overall Dutch drug cryptomarket revenue was generated 
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by cannabis and 10 per cent by psychedelics. Revenue generated by prescription drug sales for ‘Dutch’ 
listings was very small (2 per cent) in contrast to the overall picture (15 per cent). The revenue generated 
by opioids (5 per cent) was similar between ‘Dutch’ listings and listings placed by vendors elsewhere. 
Ecstasy-type listings generate much higher revenues than their number of transactions would suggest. 
Inversely, cannabis listings generate fewer revenues than expected when looking at their number of 
transactions. The overall picture for the Dutch context is that ecstasy-type drugs and stimulants are 
dominant, accounting for nearly three quarters of all the revenue generated by Dutch listings. 

4.4.2. Clear net markets 

As mentioned in Section 4.2.2, no studies were identified that estimated NPS revenues made on clear net 
markets, but studies did report on number of online shops. Other studies for example looked at a 
particular type of NPS (e.g. Nizar et al. 2015, who aimed to identify new NPS), or only looked at a 
market for a specific country (e.g. Schmidt et al. 2011, who looked at the UK market). As such, these 
fmdings should be treated with caution as they did not primarily aim to provide a revenue estimation. 
Schmidt et al. (2011) did comment on the revenues on the legal highs’ market in the United Kingdom 
more generally (£10m), yet the distribution of offline and online sales was not mentioned. 

4.5. Wholesale versus retail 

Early publications on drugs trade via Silk Road have dubbed it the ‘ebay for drugs’ (Barratt 2012, 683), 
suggesting similarities with the California-based e-commerce company offering consumer-to-consumer 
and business-to-consumer sales services via the internet. Aldridge and Décary-Elétu (2014) concluded 
however that Silk Road was not just a business-to-customer marketplace, but that there was evidence that 
‘many customers on Silk Road will have been drug dealers sourcing stock, and that in revenue terms, these 
kinds of ‘business-to-business’ sales were key Silk Road business’ (p. 16). This section investigates the 
extent to which transactions on cryptomarkets and clear net markets (Section 4.5.4) can be characterised 
as business-to-business and business-to-consumer in more detail. 

4.5.1. Not just an e-bay for drugs? 

Ebay is primarily a retail platform, rather than wholesale. There is evidence from our research, and others, 
that cryptomarkets are used by both retail and wholesale buyers. In their revised approach for calculating 
wholesale transactions on Silk Road 1.0, Aldridge and Décary-Elétu (2016a) found that a quarter of the 
revenue was generated by wholesale transactions. In 2014, journalists Kooistra and Trommelen (2014) 
reported that 61 per cent of all analysed transactions from ‘Dutch vendors’ on four cryptomarkets had a 
value of more than one bitcoin. 30 It was not specified what kind of drugs these transactions reflected. 
They also found that some ‘Dutch vendors’ were open for negotiations with buyers when bulk purchases 
were ordered (Kooistra & Trommelen 2014). Van Slobbe (2016) further noted that there have been 
examples in the Netherlands and other countries of criminal investigations where ‘buyers First [purchased] 


30 At the time Kooistra and Trommelen (2014) conducted their research, one bitcoin was €450 (the study did not 
refer to dollar value) and the study used this number to explain the possibility of bulk purchases. 
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small quantities of drugs and then, once a degree of trust has been established between the vendor and the 
purchaser, [proceeded] to purchase a large consignment for trade’ (p. 78). Several interviewees mentioned 
that online drug markets were also business-to-business marketplaces, where dealers sold and purchased 
Wholesale quantities online (e.g. EX1, EX4, EX10, EX13, LE2, LE9, LE16). 

4.5.2. Distinguishing Wholesale from retail listings 

Despite these (sometimes anecdotal) comments on and research into Wholesale, there is little guidance in 
the research literature as to what actually constitutes a Wholesale or a retail volume. Volumes associated 
with Wholesale vary considerably depending on type of drug, and legal thresholds that trigger supply 
offences vary considerably from jurisdiction to jurisdiction, with many indicating relatively small 
quantities consistent with personal use (Aldridge & Décary-Hétu 2016a). Rather than developing a 
framework that categorizes Wholesale and retail sales based on weight, we adopted a classification of 
listings based on price, and do so consistently across all drugs. The quantities involved in most purchases 
priced under $100 are sufficiently small as to be unlikely to include many - if any - purchases intended 
for profitable resale. We anticipate that listings priced at $1,000 and over are much more likely to be 
‘wholesale’ purchases made by those intending later distribution. Elowever, some purchasing at this level 
may be buying for personal use over the longer term. The designation is admittedly arbitrary, although 
some validation of this approach is found in the literature (Aldridge & Décary-Elétu 2016a). It is more 
difficult to be confident about listings priced between $100-$ 1000, and so we employed four price 
categories in the analyses that follow, with listings priced over $ 1000 as the - likely conservative - cut-off 
point for classifying ‘wholesale’ transactions. Table 4.5 presents the distribution of prices inside each 
category. 


Table 4.5. Distribution of drug listing prices within four price categories ('All' and 'Dutch' only 
drug listings) 



ALL DRUG LISTINGS 

DUTCH DRUG LISTINGS 

N 

% 

Mean 

S.D. 

N 

% 

Mean 

S.D. 

<= $100.00 

27,412 

46% 

$45 

$27 

2,623 

40% 

$45 

$26 

$100.01 - $500.00 

20,418 

34% 

$233 

$108 

2,028 

31% 

$237 

$110 

$500.01 - $1,000.00 

5,123 

9% 

$709 

$141 

630 

10% 

$698 

$149 

$1,000.00+ 

6,814 

11% 

$4,428 

$9,202 

1,245 

19% 

$5,722 

$8,139 

TOTAL 

59,767 

100% 



6,526 

100% 




Most listings are included in the first two categories. At the international level, the most expensive listing 
was priced at over $390,000 (a listing for 10 kilos of cocaine). For the bottom three categories, the mean 
price falls roughly in the middle between the lower and upper bound with reasonable Standard deviations. 
For the ‘wholesale’, prices average around $4,500 but have a much wider distribution (SD = $9,202). 
Dutch drug listings have a very similar pattern, although the listings in the top category are priced higher 
on average ($5,722 vs $4,428). These listings offer a smaller variation as indicated by the Standard 
deviation (SD = $8,139). The most expensive listing from the Netherlands is priced just below $70,000 
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and is a custom listing for 22,000 pills, 2 kg of MDMA and 450 g of cocaine. Another similarly priced 
listing offered 5 kg of ketamine with a stated purity of 80 per cent. 

Listings placed by ‘Dutch vendors’ were nearly twice as likely to be in the ‘wholesale’ price category, with 
nearly one in five listings (19 per cent) priced over $1,000; listings in the lower priced categories (at or 
under $500) are correspondingly fewer. This suggests that the Netherlands is relatively more important 
(compared to all other countries combined) in wholesale distribution, a finding that perhaps reflects the 
fact that the Netherlands is a transit and production country particularly for MDMA and some other 
synthetic stimulants, alongside cannabis (UNODC 2014). 

As we discussed above, the number of listings can be a misleading indicator of activity on cryptomarkets. 
Table 4.6 presents the distribution of sales and revenues across the price categories. The bulk of 
transactions are generated by low priced listings under $100. Wholesale listings account for only 2 per 
cent of transactions, and even using the less conservative ‘wholesale’ estimate, only 6 per cent of all 
transactions are wholesale. This suggests that most cryptomarket transactions are consistent with purchase 
for personal use or ‘social supply’ redistribution. The situation is very similar in the Netherlands where 
there are slightly more transactions in the under $100 range and slightly fewer transactions in the $100— 
$500 range. At the international and Dutch level, the majority of transactions (94—95 per cent) are 
concentrated in the lower drug price categories (up to $500). 

Table 4.6. Transactions, revenues and market share of drug listings ('All' and 'Dutch' only drug 
listings) 



ALL DRUG LISTING5 


DUTCH DRUG LI5TINGS 

Transactions 
in last month 

% 

Revenues in 
last month 

% 

Transactions 
in last month 

% 

Revenues in 
last month 

% 

<$100.00 

59,684 

64% 

$2,560,429 

18% 

5,058 

68% 

$202,180 

18% 

$100.01 - $500.00 

28,066 

30% 

$5,776,298 

41% 

2,007 

27% 

$427,739 

39% 

$500.01 - $1,000.00 

3,296 

4% 

$2,302,270 

16% 

299 

4% 

$203,993 

18% 

$1,000.00+ 

1,728 

2% 

$3,552,046 

25% 

124 

2% 

$270,151 

24% 

Total 

92,774 

100% 

$14,184,498 

100% 

7,488 

100% 

$1,104,063 

100% 


Even though small in number in comparison to retail transactions, these wholesale transactions are 
important in the marketplace: cryptomarkets continue to cater for customers making high price/quantity 
purchases, and one quarter of all the revenue generated on the marketplace is generated by transactions 
priced above $1000. The distribution of revenue across price categories for ‘Dutch vendors’ compared to 
the overall picture is broadly similar, with wholesale transactions accounting for about a quarter of the 
revenues across all listings, and for Dutch listings. The predominance for the offering of wholesale priced 
listings for ‘Dutch vendors’ does not translate into sales; actual wholesale activity is similar. This finding 
highlights the limits of assessing supply using the number of listings to describe cryptomarkets. 
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4.5.3. Wholesale tronsactions by type of drugs 

Table 4.7 presents the transactions by substance type, similar to Table 4.3, but this time only for 
Wholesale priced transactions. For all drug listings, relative contribution to revenues of different drug types 
at the Wholesale level roughly mirrors that found for all trade (see Table 4.3). Wholesale represents 
roughly 25 per cent of sales generated in all drug categories except for alcohol and tobacco where there 
were no Wholesale sales. 


Table 4.7. Sales (estimated monthly transactions and revenue) across drug categories for 
Wholesale priced drugs only (over $1,000) ('All' and 'Dutch' only drug listings) 




ALL DRUG LISTINGS 


DUTCH DRUG LISTINGS 

Transactions in ^ 
last month 

Revenues in 
last month 

% 

Transactions in ^ 
last month 

Revenues in 
last month 

% 

Cannabis 

596 

34% 

$1,112,858 

31% 

6 

5% 

$6,301 

1% 

Stimulants 

406 

24% 

$873,464 

25% 

13 

11% 

$31,318 

12% 

Ecstasy-type 

321 

19% 

$763,853 

22% 

89 

72% 

$189,588 

70% 

Prescription 

268 

16% 

$581,593 

16% 

0 

0% 

$0 

0% 

Psychedelics 

86 

5% 

$149,207 

4% 

12 

10% 

$34,763 

13% 

Opioids 

41 

2% 

$61,318 

2% 

4 

4% 

$8,180 

3% 

Other drugs 

9 

1% 

$9,753 

0% 

0 

0% 

$0 

0% 

Alcohol+tobacco 

0 

0% 

$0 

0% 

0 

0% 

$0 

0% 

Total 

1,728 

100% 

$3,552,046 

100% 

124 

100% 

$270,150 

100% 


For Dutch listings, however, the picture is very different. Wholesale activity is most concentrated for 
drugs in the Ecstasy-type category (70 per cent). Some Wholesale revenue was found for psychedelic (13 
per cent) and stimulant drugs (12 per cent), but Wholesale revenue for other drug categories for Dutch 
listings was negligible. This means that Wholesale at the Dutch level are very much concentrated in this 
single drug category. Compared to the international level where we found evidence of many different 
drugs being offered at the Wholesale level and generating revenues, at the Wholesale level, ‘Dutch vendors’, 
at least in the eight sites included in this study, appeared very much to specialise, probably reflecting the 
status of the Netherlands as a producer country for this drug (UNODC 2014). 

4.5.4. Wholesale and social distribution via clear net markets 

Like buyers who purchase illicit drugs on cryptomarkets, substances purchased on the clear net (primarily 
NPS) are sometimes also bought for re-sale purposes (e.g. Benschop et al. 2015; Cadet-Taïrou et al. 2013; 
DrugScope 2014; EMCDDA 201 la; Lavorgna 2014; Nizar et al. 2015; Stephenson & Richardson 2014; 
The New Psychoactive Substances Review Expert Panel 2014). Focusing on the Netherlands, Benschop et 
al. (2015) and Nabben et al. (2014) reported that some buyers resell large quantities of NPS bought 
Online to others. 

The UK Advisory Council on the Misuse of Drugs (2011), informed by experts, argued that the growth 
of the NPS market appears to have given rise to the entrepreneurial drug dealer, who seizes the 
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opportunity to make profits while substances remain legal. According to this Advisory Council, many of 
these dealers appeared to be new to the drugs trade and included students. 

TREND (Emerging Trends and New Drugs) sites in Bordeaux, Metz and Lille, set up as part of the 
TREND scheme established by the French Monitoring Centre for Drugs and Drug Addiction in 1999, 
observed that buyers who purchase NPS online also engage in direct sales — in other words, users and 
individual dealers who are not part of an organised crime network obtain products from the internet and 
subsequently share those drugs with friends or engage in micro traffic (Cadet-Taïrou et al. 2013). 
Similarly, Lavorgna (2014) suggested that, based on case studies of law enforcement operations and 
interviews with law enforcement representatives and experts from Italy, the USA and the Netherlands, 
some young ‘psychonauts’ are involved in small-scale trading: ‘[...] they have basically added an 
organizational layer to the trafficking chain by acting as local retailers for their (extended) circles 
(organizational opportunities). Even if most of these psychonauts seem to be involved in small-scale 
trades, a couple of interviewees underlined that in some recent cases the quantities purchased imply that 
some transactions are directed towards retailers operating on a larger scale (from business-to-consumer to 
business-to-business)’ (p. 267). 

4.6. Volumes of drugs on offer 

Given the wide range of drugs offered on cryptomarkets, it would be difficult to present the quantities of 
the many hundreds of drugs available for sale. We therefore opted to present the average weight of drugs 
per listing by price range for three exemplar drugs: cannabis, cocaine and MDMA powder. Table 4.8 
presents our analysis of the cannabis, cocaine and MDMA powder subsample. 

Table 4.8. Mean weight (g) of exemplar drugs in four price categories ('All' and 'Dutch' only 
listings) 




ALL LISTINGS 


DUTCH LISTINGS 


Cannabis 

Cocaine 

MDMA 

powder 

Canna 

bis Cocaine 

MDMA ■ 

powder j 

<= $100.00 

9.8 

1.9 

6.2 

11.7 

1.2 

3.9 

$100.01 - $500.00 

29.4 

3.4 

14.3 

26.8 

4.3 

22.7 

$500.01 - 
$1,000.00 

115.2 

10.2 

46.0 

79.7 

10.5 

71.2 

$1,000.00+ 

505.8 

141.6 

478.8 

863.0 

138.2 

712.6 


There is a very strong relationship between the price of a listing and its weight, with the average weight of 
a listing rising steadily across all price categories. This suggests that our decision to use price as a proxy for 
quantity (much more complicated to discern, assess and compare across drug types) has some validity. 
This relationship was true for all exemplar drugs across both the Netherlands and the international level. 
Our results demonstrate that large quantities of drugs were available, especially for cannabis and MDMA 
powder. In the case of cannabis, the mean weight of listings from the Netherlands was over 850 g, making 
it very likely that wholesales are the most common form of transactions at the top price category. Cocaine 
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weights were smaller than their cannabis and MDMA powder counterparts, but given their higher price 
per gram, the revenues generated at the top quartile are likely to be important as well. These results 
suggest that while price is a reasonable proxy measure for quantity sold, interesting variations are evident 
when we drill down looking between drug types and countries. Here for example, when comparing the 
‘Dutch listings’ to international listings, the average quantities for cannabis and MDMA were 
considerably higher for listings priced over $1,000. This again likely reflects the status of the Netherlands 
as a producer country for these drugs (UNODC 2014). 


Table 4.9. Volume (in grams) traded on marketplaces over the previous month 
(weight*transactions) for exemplar drugs ('All' (A) and 'Dutch' (B) only listings) 


(A) ALL LISTINGS 



Cannabis 


Cocaine 

MDMA powder 

<= $100.00 

94,244 

(19.9%) 

2,947 

(10.5%) 

5,769 

(11.8%) 

$100.01 - $500.00 

147,759 

(31.1%) 

11,425 

(40.8%) 

19,312 

(39.4%) 

$500.01 - $1,000.00 

84,949 

(17.9%) 

5,252 

(18.8%) 

9,684 

(19.7%) 

$1,000.00+ 

147,502 

(31.1%) 

8,358 

(29.9%) 

14,296 

(29.1%) 

TOTAL 

474,455 

(100.0%) 

27,982 

(100.0%) 

49,062 

(100.0%) 









(B) DUTCH LISTINGS 






Can 

nabis 


Cocaine 

MDMA powder 

<= $100.00 

3,461 

(32.2%) 

618 

(23.4%) 

1,408 

(12.3%) 

$100.01 - $500.00 

5,847 

(54.4%) 

1,182 

(44.7%) 

4,158 

(36.4%) 

$500.01 - $1,000.00 

653 

(6.1%) 

491 

(18.6%) 

2,628 

(23.0%) 

$1,000.00+ 

786 

(7.3%) 

351 

(13.3%) 

3,238 

(28.3%) 

TOTAL 

10,747 

(100.0%) 

2,642 

(100.0%) 

11,432 

(100.0%) 


Overall, we found that, the eight cryptomarkets examined facilitate the sale of nearly 475 kilos of cannabis 
a month. As a group, ‘Dutch vendors’ sell about 11 kg a month, just 2% of the total global volume of 
cannabis we estimate to be traded on cryptomarkets. The distribution of volume across price illustrates the 
same pattern as we observed looking at transactions in the $100 — $500 price range. Indeed, it is the price 
category associated with the largest volumes of substances sold, both for ‘Dutch’ and ‘international’ 
vendors. 


4.7. Other goods and services 

There are a range of other products or services offered for sale on cryptomarkets. Some may be used by 
customers to produce, manufacture, grow or synthesise drugs; others, ‘paraphernalia’ are involved in drug 
consumption (e.g. vaporizers). Aldridge and Décary-Hétu (2014) previously analysed precursors sold on 
Silk Road 1.0 and concluded that the sale of‘precursors’ (as classified by vendors) ‘demonstrated that Silk 
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Road may have helped to put not only access to bulk purchases of illicit drugs (or their precursors) into 
the hands of those without existing criminal connections to make these purchases offline, but may also 
have placed the kinds of skills previously restricted to trained and experienced chemists with an 
understanding of illicit synthesis into the hands of anyone with the time and inclination to learn’ (p. 16). 

4.7.7. Products and services supporting the drugs supply chain 

Our cryptomarket analysis aimed to capture the sales of other goods and services that support the supply 
chain of drugs. Table 4.10 presents the statistics of the sale of these products in our cryptomarket scrape. 


Table 4.10. Sales (estimated monthly transactions and revenue) for goods supporting drug 
production, supply and use ('All' and 'Dutch' only listings) 




ALL LISTINGS 


DUTCH LISTINGS 

N 

Transactions in 
last month 

Revenues in 
last month 

N 

Transactions in 
last month 

Revenues in 
last month 

Drug paraphernalia 

1,239 

545 

$12,230 

8 

0 

$0 

Cutting agents 

74 

63 

$5,948 

4 

0 

$0 

Drug precursors 

89 

37 

$5,524 

5 

0 

$0 

Equipment/guides/shipping 

927 

404 

$4,725 

0 

0 

$0 

Total 

2,329 

1,049 

$28,427 

17 

0 

$0 


Products and services supporting drug production, supply and use are listed on drug cryptomarkets, and 
generate sales, albeit in negligible amounts in comparisons to drugs themselves. The total revenue 
generated by these products and services in the month prior to data collection ($28,427) was about 0.2 
per cent of the amount generated by drug sales (over $l4m). 

We coded substances used as precursors in drug production only where those substances were not also 
taken as drugs. Ephedrine, for example, is used as a precursor in the production of methamphetamine, but 
is also used as a stimulant drug in its own right. Items coded as precursors are listed in Table 4.11. 


Table 4.1 1. Items coded as precursors 


3,4-methylenedioxyphenyl-2-propanone 

Methanol 

Acetic anhydride 

Nitric Acid 

Acetone 

Amphetamine oil 

Ethyl ether 

APAAN 

Hydrochloric acid (HCI) Lysergic acid 

Dichloromethane 

Phenylacetone (1 -Phenyl-2-Propanon) 

P2NP 

Potassium permanganate 

Potassium cyanide 

Safrole 

Xylene 

Sulphuric acid 

Aluminium powder 

Toluene 

Potassium iodide 

Sodium hypophosphite 

Isopropyl alcohol 

Red Phosphorus 

Mercury dinitrate 

Methylamine 

N-Butylamine. 
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There were only 89 listings for drug precursors, but for the reason stated above, it is likely that other 
substances sold on cryptomarkets will be used by those purchasing them as precursors in drug production. 
The precursor listings here generated a very small number of transactions and associated revenue. We 
found a similar fairly small number of listings (74) for cutting agents generating similar sales. 

There were substantially more listings (927) for equipment and shipping-related products (e.g. bags), and 
guides to drug production and shipping. These had many more transactions associated with them than we 
found for precursors and cutting agents, but revenue generated by these was similarly low, suggesting 
these were low-priced items, many of which could be sourced legally in most jurisdictions. 

Listings for drug paraphernalia (e.g. filter papers, vaporisers, rolling machines, filters) were more 
numerous (1,239), and these generated slightly more substantial transactions and revenue. This is perhaps 
unsurprising, since these products are legally available in most countries in high Street shops and on the 
Internet. 

Listings for all products supporting drug production, supply and use were minimal in the Netherlands 
(only 17 listings overall), and generated no sales in the month prior to our data collection. 

Table 4.12. Other supporting goods and services 


ALL LISTINGS 

DUTCH LISTINGS 


1^1 Transactions in 
last month 

Revenues 
in last 
month 

1 ^ Transactions in 
last month 

Revenues 
in last 
month 

Financial products and services 

1,932 

2,939 

$270,840 

14 

55 

$1,170 

Counterfeit IDs 

1,251 

570 

$30,343 

1 

0 

$0 

Equipment for doing business 

260 

71 

$3,488 

3 

0 

$0 

Counterfeit prescription templates 

5 

0 

$0 

0 

0 

$0 

Guides 

2,767 

1,588 

$6,350 

4 

3 

$7 

Total 

6,215 

5,168 

$311,021 

22 

58 

$1,177 


Among all non-drug listings, some were products or services that might be supportive in some way for 
vendors selling drugs on cryptomarkets, although these were not necessarily exclusively aimed at, or 
indeed used by, drug vendors. These included fmancial products and services 31 , equipment for doing 
business 32 , counterfeit IDs 33 , counterfeit prescription templates and guides or ‘how-tos’ 34 . The level of 
transactions and revenue generation for all these was small, although it is worth noting that many of these 
listings did not qualify as consumables (e.g. guide to money laundering), as drugs do, so re-purchase by a 
customer is unlikely - a customer is unlikely to purchase the same tutorial eBook multiple times but may 


31 This category includes Online accounts of bitcoins, financial accounts, financial transfer services, money laundering 
and other money services. 

32 This category includes bank card readers, cellphones, computers and electroniselectroniselectronicselectronis. 

33 This category includes counterfeit template IDs, scans and physical IDs, passports and diplomas. 

34 This category includes guides on bitcoins, counterfeiting, the dark web, drugs and security. 
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purchase listings for 1 g of cannabis many times over. The most commonly listed type of product was the 
financial products and services, which can help vendors launder the proceeds of their sales or the 
customers to purchase bitcoins, still a difficult task for many. Counterfeit IDs, which can be used for 
identity fraud or reducing the risks when arrested, were also popular. The Netherlands appeared to be 
absent from these activities as only the Financial products and services category produces revenues over 
$1,000. Interestingly, a small number of listings for templates for producing prescription templates (5) 
could have been used by prescription drug vendors to source stock, although we saw no sales for these in 
the month associated with our data collection. 

4.7.2. Do vendors sell other products in addition to drugs? 

Vendors on cryptomarkets are free to offer as many listings as they wish across a wide range of product 
and service types, with some individual vendors holding thousands of listings. Table 4.13 presents a 
Pearson correlation between the activity of selling drugs and of selling other types of drug-related and 
non-drug-related products. 

Table 4.13. Correlation between the different vendor activities 


Correlation to selling drugs 


Selling supply and production tools 

-.016 

Selling drug paraphernalia 

.039* 

Selling counterfeit products 

-0.333** 

Selling eBooks 

-0.426** 

Selling digital information 

-0.298** 

Selling fraud products and services 

-0.502** 

Selling miscellaneous legal products 

-0.166** 

Selling services 

-0.320** 

Selling software 

-0.296** 

Selling weapons 

-0.060** 


Pearson correlation; N = 3,846; * < 0.05; ** < 0.01. 


Most correlations were significant and negative, suggesting that drug vendors are less likely to offer 
products unrelated to drugs than non-drug vendors. Unsurprisingly, the only positive correlation with 
selling drugs was selling drug paraphernalia. The strongest negative correlations were between selling 
drugs and selling eBooks and fraud products and services. This suggests that vendors tend to specialize 
either in the sale of drugs or in the sale of other types of products, even though fraud products, services 
and guides (e.g. laundering) may be useful purchases by drug selling vendors; it is possible that these 
vendors may be customers for these non-drug, but supportive products, although our data are unable to 
shed light on precisely who makes purchases. 

Table 4.14 below examines overlap in types of products sold by vendors. Looking first at the international 
picture, we see that 71 per cent of all vendors have at least one drug listed, with a majority of vendors (58 
per cent) only selling drugs and nothing else. This suggests that cryptomarkets in 2016 remain drug 
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dominated. Only 5 per cent of vendors sell only drug-related products. However, nearly three in 10 
vendors (29 per cent) sell only products that do not include drugs. On the Dutch side, vendors show 
substantially more specialisation in drug sales. Almost all vendors (93 per cent) have at least one drug 
listing. The vast majority sell only drugs (83 per cent). This leaves a very small minority of ‘Dutch 
vendors’ (7 per cent) who do not sell drugs. This is a very striking difference to the overall picture, 
demonstrating that ‘Dutch vendors’ use cryptomarkets almost exclusively for drug sales. 

Table4.14. Distribution of vendors' activities 


ALL VENDORS 

# % of total 

'DUTCH VENDORS' 

# % of total 

Sell drugs 

2,744 

71% 

215 

93% 

Sell drugs and nothing else 

2,248 

58% 

192 

83% 

Sell drugs and drug-related products 0 

151 

4% 

6 

3% 

Sell drugs and non-drug-related products 

345 

9% 

17 

7% 

Sell anything but drugs 

1,102 

29% 

15 

7% 

Sell anything but drugs and drug-related products 

1,044 

27% 

13 

6% 

Sell anything but drugs and non-drug related products 

58 

2% 

2 

1% 

Total 

3,846 

100% 

230 

100% 


NOTE: 


a Drug-related products refer to drug production supplies and drug paraphernalia. 

4.8. Trends in Internet-facilitated drugs trade 

Up until late 2013, Silk Road controlled virtually all cryptomarket drugs trade. Since this time there has 
been considerable change, with new markets emerging every few months. This section will seek to 
compare the data collected from the eight cryptomarkets included in this study in 2016, to data collected 
from to Silk Road in September 2013, only weeks before the site was taken down by the FBI (results of 
some of the 2013 data are presented in Aldridge and Décary-Hétu 2014). Given that Silk Road was the 
dominant cryptomarket at the time, the two samples we present should be representative of the state of 
cryptomarkets in 2013 and 2016 (eight cryptomarkets sampled). Both samples were collected using the 
same methodology and the same tooi, DATACRYPTO, though the Silk Road sample was collected using 
a much less sophisticated version of the tooi (see Section 2.3). The difference in automation should not 
impact the reliability of the data collection process. For the 2016 and 2013 datasets, we compared the 
types of drugs offered, the price categories, the total revenues and market share of different drug types, 
and the listings, transactions and revenues per vendor. 

4.8.1. Types of drugs offered 

Table 4.15 presents the differences in the types of products offered on cryptomarkets in 2013 and 2016. 
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Table 4.15. Trends in categories of drug listed: Silk Road September 201 3 to multiple markets 
January 2016 


JANUARY 2016 

SEPTEMBER 2013 

N % 

N % 

Alcohol + tobacco 

70 

<1% 

262 

2% 

Cannabis 

18,369 

30% 

2.493 

23% 

Ecstasy type 

9,972 

17% 

1,045 

10% 

Prescription 

14,51 1 

24% 

3,842 

35% 

Psychedelics 

6,622 

11% 

1,521 

14% 

Stimulants 

7,852 

13% 

1,071 

10% 

Opioids 

1,979 

3% 

172 

2% 

Other drugs 

962 

2% 

430 

4% 

Total 

60,337 

100% 

10,927 

100% 


Our results suggest relative stability in the type of drugs being offered on cryptomarkets. Psychedelics, 
stimulants, opioids and other drugs have all remained relatively stable over time. In 2016, cannabis took a 
larger share of listings, as do ecstasy listings. Listings for prescription and psychedelic drugs had a smaller 
overall share of listings than in 2013. This represents a shift in cryptomarkets towards more recreational 
drugs. 

4.8.2. Price categories 

As mentioned above, the price of listings can be a good indicator of the proportion of retail and Wholesale 
sales on cryptomarkets. Table 4.16 presents the distribution of listings across four price categories. Listings 
in the top quintile could be considered as Wholesale. 


Table 4.1 6. Number of listings within four price categories: Silk Road September 2013 to 
multiple markets January 201 6 


JANUARY 2016 

SEPTEMBER 2013 

N % 

N % 

<$100.00 

27,412 

46% 

5,328 

49% 

$100.01 - $500.00 

20,418 

34% 

3,854 

35% 

$500.01 - $1,000.00 

5,123 

9% 

830 

8% 

$1,000.00+ 

6,814 

1 1% 

915 

8% 

Total 

59,767 

100% 

10,927 

100% 


The distribution of the price of listings presented in Table 4.16 has remained broadly stable over the past 
3 years, changing only of a few percentage points. Listings in the retail price category have decreased by a 
small amount, with a corresponding small increase in Wholesale priced listings. There is therefore no 
indication that the share of Wholesale listings has increased over the past years. 
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4.8.3. Revenues and market share 

As discussed above, transactions and revenues are more accurate measures of the activity of cryptomarkets 
than just the total number of listings. Table 4.17 presents the distribution of both for Silk Road and for 
the multiple markets in 2016. 


Table 4.17. Revenues and market share: Silk Road September 2013 to multiple markets January 
2016 


JANUARY 2016 

SEPTEMBER 2013 


Transactions 

in 0/ 

Revenues in 


Transactions 

in 0/ 

Revenues in 



last month 

/o 

last month 

/O 

last month 

/o 

last month 

/o 

<$100.00 

59,684 

64% 

$2,560,429 

18% 

22,306 

64% 

$1,260,996 

17% 

$100.01 - $500.00 

28,066 

30% 

$5,776,298 

41% 

1 1,245 

32% 

$3,099,883 

43% 

$500.01 - $1,000.00 

3,296 

4% 

$2,302,270 

16% 

902 

3% 

$1,052,400 

14% 

$1,000.00+ 

1,728 

2% 

$3,552,046 

25% 

575 

2% 

$1,851,947 

25% 

Total 

92,774 

100% 

$14,184,498 

100% 

35,028 

100% 

$7,265,226 

100% 


Although the number of listings across markets in January 2016 has risen nearly six-fold (see Table 4.16), 
the total number of monthly drug transactions has risen only around threefold, and overall monthly 
revenue generated by drug sales has only just doubled, from $7.3m to $l4.2m (Table 4.17). We believe 
the increases we document are ‘real’ and not an artefact of our research design, data collection methods or 
concept operationalisations. 35 Various interviewees noted that revenues on cryptomarkets are growing 
(e.g. LE9, EX13), although most did not base this on empirical data. 

The distribution of revenues remained virtually unchanged over the period, with one quarter (25%) of all 
revenues generated by Wholesale priced items. This indicates that the average purchase on cryptomarkets 
in 2016 was smaller than it was in 2013 ($153 on average versus $207). Another interesting change over 
the period (not presented in the table) is that the number of listings with associated transactions dropped 
to 20% overall (from 42 per cent in Silk Road). This is probably due to the increased number of listings 
and the heightened competition from the three-fold increase in numbers of vendors, while sales have only 
doubled. 


35 Indeed, if anything, our estimates are under-estimates for the reasons outlined in Section 2.3 (we captured fewer 
transactions through customer feedback than in September 2013; further, it is possible that our December—January 
data collection period did not cover purchases made in advance of heavier seasonal drug use). 
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Table 4.18. Sales (estimated monthly transactions and revenue) across drug categories, Silk Road 
September 2013 to multiple markets January 2016 


JANUARY 2016 

SEPTEMBER 2013 


Transactions 
last month 

in o/ 

/O 

Revenues in 
last month 

% 

Transactions in 
last month 

% 

Revenues in 
last month 

% 

Alcohol+tobacco 

63 

<1% 

$2,683 

<1% 

152 

<1% 

$5,158 

<1% 

Cannabis 

30,790 

33% 

$4,436,803 

31% 

10,663 

31% 

$2,038,213 

28% 

Stimulants 

17,206 

18% 

$3,461,023 

24% 

4,898 

14% 

$1,330,989 

18% 

Ecstasy-type 

11,031 

12% 

$2,262,850 

16% 

3,982 

11% 

$1,613,840 

22% 

Prescription 

17,984 

19% 

$2,185,147 

15% 

6,612 

19% 

$999,872 

14% 

Psychedelics 

9,993 

11% 

$1,020,059 

7% 

5,925 

17% 

$879,451 

12% 

Opioids 

5,241 

6% 

$751,021 

5% 

2,015 

6% 

$284,972 

4% 

Other drugs 

465 

<1% 

$71,457 

1% 

735 

2% 

$103,304 

1% 

Total 

92,774 

100% 

$14,194,043 

100% 

34,982 

100% 

$7,255,799 

100% 


When we examined the size of the trade of different types of drugs over time, the overall picture is more 
one of stability than change (also indicated by EX18). We did see some change, however, when we 
compared transactions and revenues generated within each drug category (both as a proportion of drugs 
revenue generated overall) between September 2013 and just over two years later, in January 2016. The 
following changes were observed. Proportionately speaking, numbers of listings for psychedelic drugs 
dropped to an extent over the period (see Table 4.15). However, the proportion of overall drug 
transactions and revenue generated by psychedelic drugs dropped from 17 per cent and 12 per cent 
(respectively) to 11 per cent and 7 per cent (see Table 4.18). We also noticed a drop in the revenues of 
ecstasy (from 22 per cent of revenues to 16 per cent of revenues) though the proportion of transactions 
remains stable. Cannabis was on the rise both in terms of number of listings but also in terms of revenues 
and transactions. The proportion of revenue generated by stimulants rosé from 18 per cent to 24 per cent, 
as did transactions for this drug (from 14 per cent to 19%). 

These results are more or less consistent with fmdings by Soska and Christin (2015), who showed that the 
fraction of market share by drug category was relatively stable between July 2013 and January 2015. In 
their results, cannabis sales constituted between a quarter and a third of all cryptomarket revenues, while 
MDMA and stimulants both remained fairly stable around a fifth during this period. 36 Soska and Christin 
reported a little less than 10 per cent of market share for both psychedelics and prescription drugs. The 
main difference is probably in the share of opioids, which was reported around 10 per cent compared to 
only 5 per cent in our results. However, this difference can be explained by the categorisation method 
used. Many drugs can be coded as either a prescription or an opioid and depending on how these drugs 
are coded, the relative size of categories will either increase or decrease. 

Soska and Christin do observe several downward spikes in cannabis revenues reaching as much as half of 
the market share. These spikes correspond to the take-down of Silk Road (October 2013), closure of 


’ Note that these figures represent market share of all products and services, including non-drugs. 
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Black Market Reloaded and the Sheep Marketplace scam (December 2013), the Silk Road 2.0 theft 
(March 2014) and Operation Onymous (January 2015). 

4.8.4. Listings, transactions and revenues per vendor 

This section has demonstrated so far that listings, transactions and revenues have evolved between 2013 
and 2016. This section presents results that suggest that the profile of drug vendors has also changed 
during that period. 

Table 4.1 9. Trends relating to cryptomarket vendors between September 201 3 (SRI) and January 
2016 (All cryptomarkets) 


JANUARY 2016 

SEPTEMBER 2013 


Min 

Max 

Mean 

S.D. 

Min 

Max 

Mean 

S.D. 

Number of listings per vendor 

1 

611 

22 

43 

1 

339 

11 

23 

Number of active listings per vendor 

1 

257 

9 

14 

1 

73 

5 

6 

Number of transactions in last month per vendor 

0 

1,709 

34 

78 

0 

187 

5 

12 

Revenues in last month per vendor 

$0 

$276,231 

$5,189 

$15,410 

$0 

$28,233 

$673 

$1,974 


N = 

2,744 



N = 

1,031 




The number of cryptomarket drug vendors has more than doubled from 1,031 in 2013 to 2,744 in 
January 2016. 37 We note, however, as discussed in the methods section, that determining the number of 
vendors relies on imperfect strategies for matching vendors with multiple accounts within and across 
marketplaces. For this reason, our estimate of the number of vendors active in January 2016 is probably 
an overestimate, as will be our estimate of the growth in the number of vendors over the period. Although 
we cannot know by precisely how much we are overestimating vendors in the post-Silk Road 1.0 era, 
growth is nevertheless apparent. 

This is consistent with fmdings from other research. Christin (2013) reported that the number of vendors 
on Silk Road 1.0 (almost all of whom sold drugs) increased from 220 in November 2011 to 564 in July 
2012. For the group of vendors selling to and within Australia, Van Buskirk et al. (2013) found that this 
increased from 282 vendors mid-September 2012 to 374 in early February 2013. For the clear net, they 
noted that the number of vendors selling to Australia went up from 92 in September 2012 to 101 in 
February 2013 (Van Buskirk et al. 2013). In their follow-up study in (using slightly different methods, see 
Table C2 in Appendix C), they found this number to be 67 in July 2014 and 78 in December 2014 (Van 
Buskirk et al., 2014). 

Soska and Christin (2015) also reported that the total number of vendors on cryptomarkets has 
considerably increased since the days of Silk Road. By the time Silk Road stopped activities in October 


37 Note that we did not undertake the same vendor-matching exercise using the Silk Road 1.0 data for two reasons: 
(1) most vendors at the time did not have a PGP key on which to undertake matching; and (2) given that there was 
only one market of note at the time, there was arguably less motivation for vendors to hold multiple accounts, 
although this may still have happened. The relatively high price of the vendor bond on Silk Road 1.0 at the time 
may further have dissuaded vendors from having multiple accounts. 
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2013, it featured around 1,400 vendors. Over their endre measurement interval, they collected a list of 
9,386 unique vendors across the crawled marketplaces (see Table Cl in Appendix C for more study 
details). Most law enforcement interviewees agreed that this picture of considerable growth in the number 
of vendors is consistent with their observations. 

The findings from Soska and Christin (2015) are also consistent with our finding that numbers of listings 
have increased since 2013 (see Table 4.16). This increase in the number of listings can be explained in 
part by a rise of the average number of listings per vendor (from 11 to 22). Many vendors operate on 
multiple cryptomarkets and probably have similar listings across each. This could explain why some 
vendors now manage a much higher number of listings. 

The maximum number of listings by a single vendor was 611. This vendor appeared to be shipping from 
North America and Asia and to ship to multiple countries, offering multiple categories of prescription 
drugs. This vendor’s revenues over the past month were $5,000. 

Vendors are also much more active in terms of transactions than they were in 2013. The average number 
of transactions per vendor has risen from five to nine transactions per month. The most active vendors are 
also much more active with upwards of 1,700 transactions in a single month. This has led to an increase 
in the average revenue per vendor per month. This figure has risen more than seven-fold over the last 
three years. Some vendors appeared to be making large amounts of money on cryptomarkets as the most 
successful vendor made an estimated $276,230 over the last month, a ten-fold increase over the most 
successful vendor in 2013. Others fall at the other end of the spectrum with $0 in estimated revenues over 
the last month. Figure 4.1 displays the distribution of estimated revenues by vendor, showing that more 
than half of the vendors make $1,000 per month. 

Figure 4.1. Distribution of estimated revenues across vendors 
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Soska and Christin (2015) reported that about 70 per cent of all vendors never managed to sell more than 
$1,000 worth of products between September 2013 and January 2015. Another 18 per cent of sellers were 
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observed to sell between $1,000 and $10,000 but only about 2 per cent of vendors managed to sell more 
than $100,000 over this period of 17 months. 

Court documents from the United States suggest (Department of Justice 2013) that the revenues of the 
arrested ‘Dutch vendor’ ‘SuperTrips’, one of the best-selling vendors on Silk Road, were 385,000 bitcoins 

between January 2011 and October 2013, which would be an average of about 11,300 bitcoins per 

38 

month. This is considerably more than the most successful vendor in our data for January 2016. 

4.8.5. New developments 

We found evidence that some vendors may be using cryptomarkets as ‘convergence settings’. This means 
that vendors could use cryptomarkets to publicize their illicit activities but use other virtual or offline 
locations to carry out transactions. Vendors and buyers could, for example, discuss a possible sale through 
encrypted emails or instant messaging after first meeting via the marketplace, but then arrange the 
transaction outside of the cryptomarkets. The buyer would therefore not be protected by the escrow 
services and the cryptomarket administrators but be offered a cheaper price as the vendor does not have to 
pay a sales commission. LEI also claimed that Wholesale vendors increasingly approach other (retail) 
vendors through private messages on dark web to offer supply. 

We tested these observations by coding 368 listings as having titles and descriptions designed obviously 
and specifically only to generate offline contact rather than sales via the marketplace. Listing prices for 
these were typically $1. These listings were held by only a handful of vendors. Examples include: 

• ‘Ketamine, Ecstasy, Cocaine, Crystal, Meths, MDMA, Eleroine, MDPV, Marijuana. Email: 
xxxxx@xxxxx.com SMS at (xxx) xxx-xxxx’. 

• ‘GET pain MEDS, Anxiety pills, weight loss pills, Sex pills and others. Email: xxxxx@xxxxx.com 
Text at (xxx) xxx-xxxx’. 

Elowever, even those vendors using listings to generate sales (with one product listed at a viable price), 
could be using cryptomarkets to generate contacts in order to transact outside the marketplace. One clue 
to this possibility is provided through vendors giving email or phone number information in the listing to 
invite customers to make direct contact. One reading of this provision of external-to-marketplace contact 
information is that vendors are inviting potential customers to make enquiries. However, the marketplace 
itself already offers this facility through the private messaging systems all marketplaces have, and offering 
publicly viewable additional contact information carries additional risks for vendors. It is possible that 
vendors might take such a strategy specifically to encourage external-to-marketplace transactions, although 
of course we cannot be certain this is the case. These data are indicative at least of the possibility. 


38 

When calculating the revenues in US Dollars or Euros, it is important however, to take the historie exchange rate 
of Bitcoins into account, which in early 2011 was still less than a Dollar. In October 2013, the value of a Bitcoin 
had already increased to more than 100 Dollars. 
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Table 4.20. Prevalence of email information in listings 


Country 

Number of listings with emails 

% 

USA 

5,782 

32% 

Netherlands 

2,127 

32% 

UK 

2,021 

19% 

Canada 

1,573 

53% 

China 

1,486 

51% 

Australia 

1,469 

44% 

Germany 

1,374 

26% 

India 

542 

46% 

Afghanistan 

213 

42% 

Unknown 

476 

10% 


There was email/IM contact information associated with 28,436 listings (27 per cent) and 801 vendors 
(21 per cent) across all cryptomarkets. Listings from China and Canada had email addresses associated to 
them over 50 per cent of the time. The listings from the Netherlands had email addresses associated to 
them about a third of the time, a level similar to that of the United States. These fmdings do not suggest 
that all cryptomarket vendors provide extra-marketplace contact avenues and then actually use these to 
communicate with buyers. They are, however, indicative of a willingness to open communication 
channels that cannot be monitored simply by monitoring the cryptomarkets themselves. That is, 
cryptomarkets may generate sales that are not processed via the marketplace. 

4.9. In sum 

We found evidence of a substantial growth in cryptomarkets since the closure of the first major drug 
cryptomarket, Silk Road 1.0, in September 2013. The number of listings for drugs has seen a nearly six- 
fold increase; the numbers of vendors and transactions have nearly tripled; and revenue (aka ‘turnover’) 
has doubled over the period. As was discussed in Section 2.3, these revenue estimates likely underestimate 
the true extent of revenues generated on cryptomarkets. Indeed, our DATACRYPTO tooi only captured 
about 80 per cent of listings and a minority of transactions (likely around 20 per cent) did not lead to 
public feedbacks. 

We found that large ‘wholesale’ level transactions remained important for cryptomarkets, generating 
nearly one quarter of overall revenue in September 2013, and in January 2016. This is an important 
finding. Cryptomarket trade may have an impact beyond creating a new way for drug users to access a 
wide range of drugs; we believe it is likely that many cryptomarket customers may be drug dealers 
sourcing stock intended for offline distribution. Cryptomarkets may therefore continue to be diffusing a 
wide range of substances into local offline drug markets. For clear net markets, there were some 
indications that online purchasing of NPS in wholesale quantities for the purpose of retail or social 
supply. 
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Trends in relation to the types of drugs sold on cryptomarkets and their relative importance as assessed by 
sales (transactions and revenues) showed continuity over the assessed period. The key drug categories 
remained cannabis and ecstasy-type drugs — with stimulants taking on increasing market share (perhaps in 
part due to increasing numbers of these coming onto the market in the form of NPS) and psychedelic 
drugs a correspondingly lower market share. Prescription drug sales remained numerous and important 
(made up mostly of benzodiazepines and opioid medications), but non-prescription opioids (mostly 
heroin) remained fairly small in terms of overall trade. 

Vendors likely to be based in the Netherlands showed clear patterns of specialisation, with three quarters 
of all revenue generated in two drug categories: ecstasy-type drugs (accounting for nearly half of all 
revenue for these vendors) and stimulants (another quarter). At the Wholesale level, this specialisation 
becomes even greater, with these two drug categories accounting for 82 per cent of all Wholesale revenue 
for ‘Dutch vendors’. This specialism likely reflects the Netherlands’ role in the production of these drug 
types, making vendor access to these substances relatively easy and also profitable given location in the 
supply chain. 

Listings for drug-related products (paraphernalia, equipment, precursors, guides) were sold on 
cryptomarkets, but generated minimal revenue; ‘Dutch vendors’ appeared to have little if any 
involvement. Cryptomarkets remained dominated by drug sales, and vendors tended to specialise in 
drugs, with some also selling drug related products. Only about one in three vendors sold non-drug 
products and services, and these vendors did not tend to sell drugs as welk 

In comparison to the understanding we generated about mostly illegal drug sales on the hidden web, we 
were unable to learn as much about the undoubtedly growing clear net sales of legal substances. The 
research literature here is comparatively limited (in spite of the fact that these markets have existed for 
longer than cryptomarkets), likely in part due to the fact that the data that can be obtained via digital 
tracé methodologies deployed on the clear net teil us only about substances listed for sale there and their 
prices, and not the extent to which sales occur. Nevertheless, we conclude from our analysis that there has 
been a growth in the availability of NPS through online web shops in Europe. 
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5. Shipping routes 


Cryptomarkets are international platforms where vendors from anywhere in the world can put up listings 
for products that will be shipped to anywhere in the world. Cryptomarkets therefore hold the potential of 
breaking down national barriers and to facilitate the drugs trade at an international level. An important 
question is whether the Internet facilitates important trafficking routes in addition to offline trade. Or is it 
primarily a mechanism to facilitate the domestic distribution of drugs? This chapter primarily focuses on 
the international nature of cryptomarkets and more precisely on the shipping routes that drugs sold on 
cryptomarkets take (research questions’ cluster C, and partially D, see Table 1.1). We analyse the main 
countries from which vendors operate and where they are willing to shop to. Special attention is paid to 
the role of the Netherlands in these shipping routes. 

5.1. Country of origin of drugs traded and vendors operating from the 
Netherlands 

Our analyses are based in parts on the vendor-specified ‘shipping from’ and ‘shipping to’ data point 
collected by DATACRYPTO as well as interviews with experts and law enforcement officials and data 
collected from our literature review. Chapter 2 presented in details the limits of using information 
supplied by vendors given that no verification is made by cryptomarkets to validate it 39 . The ‘ship from’ 
and ‘ship to’ data from cryptomarkets should be analysed critically. 

This section first presents statistics on the number of vendors, the revenues per month and per vendor for 
each country where at least one vendor is active (Section 5.1.1). These analyses suggests that the 
Netherlands play a prominent role among all the countries involved in the drugs trade facilitated by the 
Internet. Moreover, ‘Dutch vendors’ appeared to specialise in specific substances (Section 5.1.2). 
Interviews and the literature review provide more evidence for this role and on countries of operation on 
the clear net (Section 5.1.4). Listing descriptions were analysed to determine whether vendors operating 
from the Netherlands are presenting themselves from other countries (Section 5.1.4). To do so, an 
analysis of the listings that mention the Netherlands is presented. The possible destinations of listings are 


39 Vendors could either say their products shipped from a country and then ship them from another or could 
physically cross a border to ship their drugs from another country. It is doubtful that the former strategy will be 
commonly used by vendors. Indeed, customers who believe they are purchasing drugs from a Dutch vendor are 
likely to report it through feedback, if the product was not shipped from the Netherlands. This may harm the 
vendor’s feedback scores and therefore reputation. 
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presented with an analysis of the revenues and number of transactions for the regions where vendors are 
willing to ‘ship to’. 

5.1.1. Country of operotion of vendors on cryptomarkets 

Only a few studies identified in the literature review commented on the (reported) country of operation of 
vendors on cryptomarkets (Aldridge & Décary-Hétu 2016a; Bartlett 2015; Christin 2013; Dolliver 2015; 
Dolliver & Kenney 2016; Phelps & Watt 2014). The results from those studies confirm the prominent 
role of the United States and United Kingdom followed by several countries, including the Netherlands. 
Christin (2013), for example, found that the top five ‘most frequent shipping origin’ on listings on Silk 
Road 1.0 were: United States (43.83 per cent); undeclared (16.29 per cent); UK (10.15 per cent), the 
Netherlands (6.52 per cent) and Canada (5.89 per cent) (p. 5). Our results suggest that, since these first 
published studies, Australian vendors have gained foothold on cryptomarkets, as Australia did not feature 
among the top vendor countries in those earlier publications. Table 5.1 presents further information on 
the distribution of vendors, transactions and revenues on all eight cryptomarkets. 


Table 5.1. Countries from which drug vendors operate: vendors, transactions and revenue 


Number of 

Transactions in 

Revenues in last month 

Monthly revenue (per 

vendors 

last month 

Amount Share 

vendor) 


USA 

890 

28,883 

$5,099,153 

35.9% 

$5,729 

UK 

338 

20,748 

$2,286,196 

1 6 . 1 % 

$6,763 

Australia 

185 

6,268 

$1,501,497 

10.6% 

$8,116 

Germany 

225 

11,039 

$1,189,337 

8.4% 

$5,285 

Netherlands 

225 

7,536 

$1,104,063 

7.8% 

$4,906 

Canada 

146 

3,007 

$1,012,883 

7.1% 

$6,937 

France 

68 

2,051 

$242,836 

1.7% 

$3,571 

Spain 

30 

385 

$130,520 

0.9% 

$4,350 

Multiple 

775 

9,079 

$1,183,238 

8.3% 

$1,526 

Unknown 

265 

868 

$41,997 

0.3% 

$158 

Others a 

287 

868 

$399,324 

2.8% 

$1,391 


NOTE: 


a All remaining countries (N = 50) were combined. 

Out of the 3,846 vendors active in any of the eight cryptomarkets analysed, we found 225 vendors that 
‘ship from’ the Netherlands on at least one of their listings (these vendors indicated other shipping 
locations on other listings). Those shipping from the USA were most numerous (890), followed by UK 
(338), Germany (225) and Australia (185) (a ranking confirmed by LE15). Overall, ‘Dutch vendors 1 
accounted for 7.8 per cent of total drug revenues from the eight markets monitored (9.1 per cent if 
prescription drugs and alcohol/tobacco were excluded). This makes the Netherlands the fifth largest 
‘vendor country’ by revenues, after the United States (35.9 per cent), United Kingdom (16.1 per cent), 
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Australia (10.6 per cent) and Germany (8.4 per cent). Listings with no ‘ship from’ mention or ‘ship from’ 
that indicated regions (e.g. ‘Europe’) represent 8.6 per cent of all drug revenues. 

We found, based on the monthly revenues per vendor measure, the largest revenues were for cryptomarket 
vendors shipping from Australia, perhaps unsurprising given the disproportionately high Street price for 
illegal drugs there compared to other countries (Van Buskirket al. 2013), a point also noted by an 
interviewee (LEI). Canada, the UK, the USA, Germany and the Netherlands followed in descending 
order of revenues. In all cases, the revenues generated appeared fairly large (in absolute terms) and 
presented significant revenue for individuals though, once again, these were gross revenues and not 
profits. 

With regard to Wholesale revenue generation (>$1,000) on Silk Road 1.0 (September 2013), Aldridge and 
Décary-fdétu (2016a) found that countries with the highest share of listings priced over $ 1,000 were: 
China (46 per cent), Belgium (20 per cent), Canada (15 per cent) and the Netherlands (12 per cent). 
Finally, Dolliver’s analysis of Silk Road 2.0 concluded that for drug items, vendors mainly indicated to 
ship from the USA (26%), Germany (14 per cent), UK (13.8 per cent) and Australia (13 per cent). 
Vendors from the Netherlands represented 6 per cent. 

Drug revenues from each country are likely to fluctuate depending on the domestic expenditures on 
drugs. With its large population, the United States is more likely to have a correspondingly large vendor 
population and hence higher overall drug revenues. The Netherlands appears to have a substantial 
concentration of cryptomarket vendor activity is (13.4 vendors per million population) in comparison to 
the United States (2.8 vendors per million population) and the United Kingdom (5.3 vendors per million 
population) for instance (see Table 5.1). 

This revenue analysis demonstrated that sales are dominated by vendors in North America, Europe and 
Australia, even though vendors operated from dozens of other countries. These high-income countries are 
likely also to have better access to computers and the Internet, providing them with an edge for 
participating in cryptomarkets as vendors over smaller and poorer countries. Another explanation for the 
relatively large share of countries like the United States and United Kingdom may lie in their home 
consumer markets. It may be that both customers and vendors may prefer to reduce their risks (such as 
parcel loss, interception by authorities or arrest) by selling or purchasing that involves shipping only 
within their country of residence (Décary-Elétu et al. forthcoming). Interviewees (EX12) also noted that 
buyers may prefer to communicate in their native language and domestic buyers may improve perceived 
customer fidelity. LE7 reported that France, for instance, has a relatively large domestic market for drugs 
sales via cryptomarkets. Referring to Silk Road, Christin (2013) noted that this is not surprising since all 
Communications are in English. Although since then several non-English language markets have 
appeared 40 , English remains the dominant language. This may be a consequence of the dominant position 
of Anglo-Saxon countries in Internet-facilitated drugs trade. But English, as the Internet’s lingua franca, 
may also act as an entry barrier to cryptomarkets for non-English speaking vendors. 


40 For instance: Finnish (Silkitie), Russian (Ramp, RuTor, Russian Silk Road), French Dark Net (French Dark Net), 
and Italian (IDC) 
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5.1.2. Vendors' country of operotion and substonce types 

Data presented in Chapter 4 confirmed that ‘Dutch vendors’ tend to have a very large share in global 
ecstasy-type drug (including MDMA) revenues (23.3 per cent) on the eight cryptomarkets analysed. 
Ecstasy made up almost half of all drugs revenues by ‘Dutch vendors’ on these cryptomarkets. Experts 
confirmed an image of the Netherlands as one of the prime suppliers of ecstasy on cryptomarkets (LE2, 
LE9, LE15, EX3, EX4). 

The large share of MDMA ecstasy by ‘Dutch vendors’ seems to be driven by the earlier mentioned 
dominant role of the Netherlands in its production. Interviewees sketched a picture where ecstasy vendors 
either have their own production facilities, mostly in the province of Noord-Brabant, or have close ties to 
producers (Focus Group, LEI, LE7). International price differences make it attractive to sell these pills to 
buyers abroad (EX12). An ecstasy pill in Australia may cost AUS$35 (ca. €23) compared to only €1.50 in 
the Netherlands (LEI). 

Many interviewees also mentioned the dominant role of ‘Dutch vendors’ in cannabis trade on 
cryptomarkets (LE2; LE9; EX3). Kooistra and Trommelen (2014) estimated that 27.5 per cent of 
revenues for ‘Dutch vendors’ is generated by herbal cannabis and 16.4 per cent by cannabis resin. 

LE2 argued that online cannabis sales by ‘Dutch vendors’ is driven by Netherlands’ position in the 
international cannabis trade, which (s)he argues, is linked to its coffeeshop policy. It may be lucrative for a 
producer or wholesale dealer to sell online in addition to his supply to coffeeshops. Law enforcement 
representatives (e.g. LE2) had reasons to believe that large cannabis vendors are geographically close to 
production and wholesale, because of the quantities they sell. 

Our data, however, suggested that ‘Dutch vendors’ only account for 2.3 per cent of the total cannabis 
revenues from the eight markets (see Table 4.3), a share that is much lower than their total market share 
of 7.8 per cent across all substances. This was echoed by LEI, who noted that only few ‘Dutch vendors’ 
are involved in selling cannabis online. Table 4.3 shows that ‘Dutch vendors’ tend to generate more 
revenues from stimulants (including cocaine) and psychedelics. Indeed, interviewees also noted the 
prominence of‘Dutch vendors’ in the sales of ketamine, C2B, LSD, speed and cocaine (LEI, LE2, LE7, 
LE9). According to LE2, sales of ketamine, for instance, which is relatively easily available in the 
Netherlands, is only recently becoming more popular among ‘Dutch vendors’. 

5.1.3. Potentiol biases in the vendor counfries 

Various interviewees indicated that the Netherlands is increasingly on the radar of borders officials in 
other countries, with Australian borders officials reportedly screening 100 per cent of packages coming 
into the country from the Netherlands. It is likely that other countries have policies of increasing vigilence 
for packages coming in to their countries from the Netherlands (LEI, LE9, LE11, EX4). ‘Dutch vendors’ 
may respond by sending packages via intermediaries in other countries, or by travelling to neighbouring 
countries to make these shipments themselves, endeavouring to keep their shipments under the radar. In 
particular, law enforcement interviewees (e.g. LEI, LE9, EX3, Focus Group) mentioned that various 
‘Dutch vendors’, or their aides, travel to Germany to post packages. A recent arrest of a ‘Dutch vendor’ 
planning to post a hundred packages totalling 100,000 ecstasy pills in Germany (NOS 2016a) seems to 
confirm this practice. 
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We were able to fmd some empirical evidence for this practice. To investigate this, we examined all 
listings not indicating they ‘shipped from’ the Netherlands and searched their product descriptions for 
mention of the following words: Dutch, Netherlands, Holland, NL and NLD. We found that, among 
drug listings using one or more of these words, 4,464 (8.3 per cent) were associated to non-‘Dutch 
vendors’. 41 There could be a range of reasons for mentioning these words. As one example, ‘Dutch’ is 
considered a quality indicator for MDMA, and so (say) a German vendor might then refer to ‘Dutch 
quality’ MDMA. However, some of these vendors indicating that they ‘ship from’ countries other than 
the Netherlands might actually be ‘Dutch vendors’ who do, in fact, ship from other countries. The fact 
that a predominance of these listings mentioning ‘Dutch’ and variants resided in countries neighbouring 
or nearby countries (Belgium, Germany, France and the UK) is further suggestive of this possibility. 

Table 5.1 shows that a large proportion of vendors on these marketplaces did not indicate one single 
‘shipping from’ country from which products would be shipped, but instead indicated larger areas (e.g. 
‘Europe’). This is indicated as Multiple in this table. Vendors may also obfuscate this information in other 
ways such that we were unable to identify a single country. This is indicated as Unknown in the table. 
Vendors obfuscating their country of operation did not appear to prevent sales completely. However, they 
did generate the lowest monthly revenue on a per-vendor basis, compared to vendors that indicated the 
country from which products would be shipped. 

5.1.4. Country of operation for vendors on the clear net 

Previous chapters explained that drugs trade facilitated by the clear net tends to be dominated by NPS. 
Similarly, a review of the literature found that NPS do not appear to be frequently purchased on 
cryptomarkets (Stephenson & Richardson 2014). In terms of non-controlled NPS, Stephenson and 
Richardson (2014) stated that there is little advantage for users to use cryptomarkets when the substances 
are easily available on the clear net. 

Schmidt et al. (2011) found 39 online shops in the United Kingdom in 2009, and research by Bigdeli et 
al. (2013) identified 51 Persian language websites aimed at ‘NPS purchase’ between 2011—2012 (p. 512). 
Authors reporting on the I-TREND project (Martinez et al. 2016) found that in May 2014, most online 
shops selling NPS were from the United Kingdom (207) and Poland (72). Some 19 shops were identified 
to be operating from the Netherlands (Table 5.2). EX3 echoed that sales of NPS do not seem to play an 
important role in the Netherlands. 42 The interviewee argued that this may be due to the relatively 
developed market for illicit substances in the Netherlands, where stimulants, psychedelics and ecstasy-type 
drugs are relatively cheap and easily available. In other countries the drug market is different and 
disrupted, which might lead to ‘people to NPS’ (EX3). 


41 i.e. vendors who indicated they are shipping from countries other than the Netherlands. 

42 There is one exception: 4-FA. As reported in the media, this particular NPS is gaining popularity in the 
Netherlands and is purchased online as well as offline. For recent media coverage, see NOS (2016b). 
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Table 5.2. Number of online shops selling NPS 



CZ 

FR 

NL 

PL 

UK 

Total 

Number of shops identified between 
November 201 3 and May 2014 

33 

112 

27 

103 

309 

584 

Number of active shops remaininq in 
2014 a 

May 30 

64 

19 

72 

207 

329 

Share of: 

Commercial/Branded shops 

13% 

28% 

26% 

17% 

19% 


...Herbal shops 

43% 

28% 

11% 

1% 

2% 


...Research Chemical shops 

43% 

33% 

63% 

82% 

76% 


...Other 

0% 

11% 

0% 

0% 

2% 


Active online shops by IP location i 
2014 

n May 






...Czech Republic 

42% 

1% 

0% 

7% 

2% 


...Germany 

0% 

11% 

4% 

8% 

7% 


...Netherlands 

6% 

38% 

52% 

6% 

4% 


...Poland 

3% 

1% 

0% 

48% 

1% 


...United Kingdom 

6% 

4% 

11% 

2% 

14% 


...United States 

18% 

24% 

19% 

16% 

44% 


...Other 

24% 

21% 

15% 

15% 

29% 



NOTE: 


3 With duplicates removed. New online shops collected in November 2014 have not been included in this table. 
SOURCE: Martinez et al. 2016, 101-102. 

I-TREND also investigated the online shops’ IP addresses, which did not always concur with the country 
of the targeted consumer market. The authors found that ‘the unique sales sites intended for the Czech, 
Dutch and Polish markets are more likely to be locally based (CZ, 42%; NL, 52%; PL, 48%) than those 
intended for, for example, France, where sites are often located in the Netherlands (38%) and the United 
States (24%). This is also the case for the United Kingdom (44% located in the United States)’ (Martinez 
et al. 2016, 102). These results suggested that approximately 50 out of 392 active shops identified had 
their physical presence in the Netherlands. 

It should be noted that thus far most research efforts have focused on the western world. This is partly 
because NPS use has been seen as primarily a Western phenomenon (Mahapatra and Sharma 2016). 
There is little reliable data available on the consumption, sales or distribution of NPS in other parts of the 
world. However, as production of NPS is often linked to Asian countries such as China, Malaysia, the 
Philippines, India and Pakistan (EMCDDA 2016a; APAIC 2016; Dargan and Wood 2012; UNODC 
2015), Mahapatra and Sharma (2016) argue that Asian countries could provide a fertile ground for 
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consumption as well. They therefore advocate the extension of the snapshot methodology to Asia with the 
aim of exploring and monitoring the Online market of NPS amongst Asian population. 

5.2. Data on demand side of Internet-facilitated drugs trade 

In this section, we analyse the most common shipping routes, suggesting that domestic sales play an 
important role in cryptomarkets (Section 5.2.1). While DATACRYPTO does not provide any 
information on the cryptomarket buyer population, the literature review will provide some clues on the 
size and scope of this population (Section 5.2.2). 

Data scraped from cryptomarkets only teil us something about the ‘supply side’. Information about the 
location of customers making purchases was not available. The cryptomarket analysis was able to identify 
the willingness of vendors to ship to particular countries, which may provide an insight into the demand 
side. There have, however, been some studies looking at the buyer population (both for cryptomarkets 
and the clear net) that may complement the supply side data (see Table 5.5). Of these studies, only one 
used a nationally representative sample (the Crime Survey for England and Wales) and found that 1 per 
cent of those aged 16 to 59 having used drugs bought these drugs online. 

The following sections describe vendors’ willingness to ship to other countries and data on the size of the 
buyer population respectively. 

5.2.1. Willingness to ship to other countries 

Success rates, associated feedback and customer ratings are of crucial importance for the success of 
vendors’ businesses (Cox 2016a). Therefore, they sometimes avoid shipping to countries where the 
(perceived) risk of interception is relatively high (LE2). The introduction of stringent scanning in 
Australia of all incoming parcels from the Netherlands, for instance, has caused many ‘Dutch vendors’ to 
refrain from serving customers in Australia (LEI, LE9), but the United States, Canada and Finland have 
also been mentioned as countries where stringent scanning practices have been introduced (LEI 1). Using 
such ‘willingness to ship to’ information in our analysis of cryptomarket data allowed us to offer some 
indication of the demand side. 

Table 5.3 includes only vendors willing to ship to the region indicated. As such, we know all sales 
associated to these vendors will be in relation to sales to these countries and regions. This table includes 
information relating to less than half of the total vendors across the eight markets, since many vendors 
were willing to ship to multiple or unknown regions (shown as Unknown in the table). The picture 
painted here may therefore be misleading; those shipping across multiple regions (e.g. ‘Worldwide’, for 
example) may draw on a differently distributed - in geographical terms - customer base. We were thus 
limited in our ability to identify where all products are actually shipped. Many vendors are willing to ship 
to the United States, making it the destination with the highest revenues (over $4m). This is not 
surprising given that many vendors operate from that region. 
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Table 5.3. Distribution of transactions and revenues across regions shipped to (All drug listings) 



Number of vendors 

Transactions in last month 

Revenues in last month 

USA 

717 

24,058 

$4,292,975 

Oceania 

192 

6,016 

$1,460,901 

Northern Europe 

195 

5,470 

$499,741 

Western Europe 

91 

2,244 

$272,430 

Canada 

22 

155 

$16,225 

Southern Europe 

6 

1 

$132 

Eastern Europe 

3 

2 

$86 

Middle East 

1 

0 

$0 

Nothern Europe 

1 

0 

$0 

South America 

1 

0 

$0 

South-Eastern Asia 

1 

0 

$0 

Unknown 

1,840 

55,493 

$7,648,553 

Total 


93,439 

$14,191,043 


Oceania (Australia and New Zealand) has been shown in the literature to be a very active place for 
cryptomarkets and Table 5.3demonstrates that vendors willing to ship to its countries (Australia, New 
Zealand) generated over 6,000 transactions and almost $1.5, in revenues. Europe is also a very popular 
destination for cryptomarket vendors to indicate they are willing to ship products. Vendors willing to ship 
to Western and Northern Europe rank in third and fourth place with combined revenues that represent 
half of Oceania. 


Table 5.4. Most common shipping routes on cryptomarkets (All drug listings) 


Shipping route 

Number of listings 

Number of 
transactions 

Month ly 
revenues 

North America => North America 

11,859 

25,908 

$4,944,125 

Europe => Europe 

8,901 

20,543 

$2,213,464 

Oceania => Oceania 

2,639 

6,003 

$1,452,546 

Asia => North America 

117 

31 

$13,127 

North America => Oceania 

16 

7 

$6,888 

Africa => Europe 

15 

8 

$1,218 

Europe => North America 

14 

7 

$933 

South America => North America 

3 

5 

$670 

Asia => Europe 

9 

2 

$16 

Asia => Asia 

11 

1 

$12 

Routes with no revenues 

25 

0 

$0 

Incomplete routes 

27,177 

34,783 

$4,805,614 

Unknown origin and destination 

9,551 

6,143 

$752,430 
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Table 5.4 presents another perspective on the route that drugs may take through cryptomarkets. Here 
again, we only have access to partial information as many vendors did not indicate where they shipped 
from and/or where they were willing to ship to. Still, our results indicate that the most common shipping 
route was from and to North America (almost $5m in revenues). These shipping routes were likely 
composed of mostly American vendors selling domestically to customers in the United States. The second 
most important route, based on the available data, goes from Europe to Europe with over $2m in 
revenues. The three most important routes all indicated that the shipments stayed in the same continent, 
perhaps to limit the risks of interception and inspection. All other shipping routes provided negligible 
transactions and revenues. 

Our data show that most listings had at least some information about ‘shipping to’ or ‘shipping from’. 
The incomplete routes are missing either the origin or the destination of the drug, which could still 
provide some information on the shipping route used for the drugs. We are only missing information on 
5 per cent ($752,430) of the revenues. 

Unfortunately, we could only fmd 7 listings that shipped explicitly to the Netherlands. While there are 
undeniably many transactions from customers in the Netherlands, our DATACRYPTO sample is unable 
to provide us with any information regarding them. The 7 listings are offering MDMA, speed and hash 
and are advertised on 3 markets by 3 different vendors. 

The lion’s share of revenues for ‘Dutch listings’ are shipping to Europe, generating over $235,000. A very 
small minority shipped to North America, ffere again however, the vast majority of shipping routes are 
unknown and this result must therefore be interpreted with caution. 

5.2.2. Estimating the size of the buyer population 

There was limited information available on the size of the buyer population, both for the cryptomarkets 
and the clear net. Anecdotal comments in the literature on buyers on Silk Road 1.0 referred to 30,000 to 
150,000 active customers (date not specified, Christin 2013), with reportedly 147,000 active buyer 
accounts in July 2013 (Maddox et al. 2016). Only one study, the Crime Survey for England and Wales 
Crime Survey for England and Wales, was based on a nationally representative sample and found that 1 
per cent of 16 to 59 year olds that used drugs (unspecified) bought them online (‘online’ not further 
specified). In comparison, almost 60 per cent obtained them from someone well-known (other than 
family members). 

There was limited information for the Dutch buyer population specifically. Where information was 
available, estimating the size of the total buyer population was mainly not the primary goal of the studies 
identified, yet was included in a subset of questions, or was only estimated for a particular type of drugs or 
group of buyers. As such, based on the information provided in these studies, a full picture of the size of 
the buyer population could not be provided. 

Examples of the relevant studies identified are included in Table 5.5. Given the limited number of studies 
and the fact that for most of the studies ‘internet’ is not further specified, cryptomarket and clear net data 
are presented in one table. Where applicable, (indications of) the size of the Dutch buyer population is 
indicated in bold. 


71 


RAND Europe 


Internet-facilitated drugs trade 


Based on findings of some of the studies outlined in Table 5.5, the sale of NPS might take place 
predominantly offline, rather than on the internet (Advisory Council on the Misuse of Drugs 2011; The 
Gallup Organisation 2011; Stephenson & Richardson 2014; The New Psychoactive Substances Review 
Expert Panel 2014; Van Amsterdam 2015). 43 For instance, a study involving qualitative interviews with 
25 experienced drug users in the Netherlands found that NPS were mainly obtained through friends, with 
seven users indicating that they sometimes ordered NPS through internet websites, and two reported 
purchasing NPS from a trusted dealer (Van Amsterdam 2015). Users would share information about 
websites offering NPS or introducé friends to a dealer (Van Amsterdam 2015). In addition, the Flash 
Eurobarometer Number 330 on youth attitudes to drugs found that of nearly 600 respondents in 27 EU 
countries, only 7.3 per cent of those who had used NPS purchased the substances on the internet (The 
Gallup Organization 2011). Similarly, the Flash Barometer Number 401 on young people and drugs 
found that only 3 per cent of NPS users across 28 EU countries bought the substances on the internet 
(TNS Political and Social, 2014). In both surveys, none of the Dutch respondents indicated to have 
bought NPS online. 


Table 5.5. Examples of studies that commented on or had details related to the size of the buyer 
population 44 


Study details (survey Key findings 

title provided if 

applicable) 


Antenne 2014 
(Benschop et al. 
2015). 

Report 


Findings from a 2014 survey conducted among visitors of bars in Amsterdam showed that 
of those who recently used GHB (n = 49), 4.1% bought GHB on the internet ('internet' 
not further specified), compared to just under 40% who obtained GHB from a dealer. 
None of the respondents who recently used ecstasy (n = 262), cocaine (n = 150), 
amphetamine (n = 1 02) bought these substances online. 


Van Buskirk et al. 
(2016) 

Academie paper 


Findings from interviews with a purposive sample of 745 participants - that regularly used 
drugs - of the Australian 'Ecstasy and related Drugs Reporting System' in 2014 showed that 
1 2% ever bought drugs on the dark net. 


Van Amsterdam et al. Interviews with 25 experienced recreational drug users in the Netherlands in 201 2 found 
(2015). that they mostly obtained NPS through friends, with seven drug users indicating to have 

Academie paper bought them sometimes via the internet ('internet' not further specified). 


Table continues on next page 


43 Based on the context in which the information was reported, it is likely that the sources referred to the clear net. 

44 The authors are aware of annual surveys conducted in Spain (EDADES, ETUDES, Early Warning System) and 
Hungary (National Focal Point) that include questions on online drug purchases, yet given language constraints 
these are not discussed here (Trautmann, 2016). 
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Table 5.5. Examples of studies that commented on or had details related to the size of the buyer 
population (continued) 


Study details (survey Key findings 

title provided if 

applicable) 


Global Drugs Survey 
(Barrattetal. 2014; 
GDS 2015). 

Academie paper; 
website 


Flash Eurobarometer 
on youth attitudes on 
drugs (The Gallup 
Organization 2011; 
TNS Political and 
Social 2014). 

Both reports 


Crime Survey for 
England and Wales 
(Home Office, 2014). 

Report 

Gonzalez et al. 
(2013). 

Academie paper 


Gordon et al. (2006). 
Academie paper 


Recent findings of the 2015 Global Drugs Survey, as conducted in 2014 and with over a 
1 00,000 responses (non-representative sample), showed that 3.8% of Dutch respondents 
purchased drugs on the dark net over the past 1 2 months. 

Barratt et al. (201 4) reported on findings of the annual Online Global Drugs Survey as 
conducted in 2012/2013. The authors looked at a purposive sample (non-representative) 
of 9,470 respondents from Australia, the United Kingdom or the United States or who used 
the currencies from those countries, who 'indicated that they usually bought their own 
amphetamine, cannabis, cocaine, 3,4-methylenedioxy-N-methylamphetamine (MDMA), 
ketamine or mephedrone, or who reported buying 'legal highs'/'research Chemicals' or 
any drugs Online during the last 1 2 months' (p. 775). It was found that 1 8% of the US 
respondents, 1 0% of the UK respondents and 7% of the Australian respondents bought 
their drugs on Silk Road. The most commonly obtained drug from Silk Road across the 
three countries was MDMA (53-60%). 

In 201 1, out of a sample of 597 young people from 27 Member States who indicated to 
have used NPS, 7.3% indicated to have bought NPS on the internet ('internet' not further 
specified). In comparison, over half of the sample obtained NPS through friends (54.2%). 

None of the respondents in the Dutch sample (n = 17) indicated to have bought NPS 
Online. 

In 2014, 3% of young people from 28 Member States who indicated having used NPS in 
the past 12 months bought these substances over the internet (sample not provided and 
('internet' not further specified). 68% received or bought NPS from a friend. None of the 
respondents in the Dutch sample (sample size not provided) indicated to have bought 
NPS online. 

In 201 3, 1 % of people from England and Wales aged 1 6 to 59 who indicated to have 
used drugs (not further specified) in the past 12 months bought their drugs online ('online' 
not further specified). In comparison, 57% obtained them from someone well known (not 
being a family member). The survey is based on a nationally representative sample. 

Findings from a cross-sectional survey carried out at music festivals, NGOs and a drug 
forum among 230 Spanish research chemical (RC) users in 2010 and 201 1 found that 
74.5% of the sample of RC users Consulting drug forums (n = 112) acquired RC through 
the internet ('internet' not further specified). This was 25.5% for the sample of those not 
Consulting drug forums for information about RC (n = 1 1 8). 

Semi-structured interviews conducted between 2003 and 2004 among 100 'adult drug- 
dependent inpatients in a private residential treatment program' (p. 271) in Pennsylvania 
(United States) found that eleven people obtained their drugs or found a drug dealer 
through the internet ('internet' and 'drugs' not further specified). Of this group, nine actually 
bought drugs online, with two having found a dealer through chat rooms. 


5.3. In sum 

Cryptomarket vendors have set up listings that appear to be shipping from dozens of countries. Based on 
drug revenue generation, the United States was the most prominent country with 36 per cent of all drug 
revenues going to vendors who advertise shipping from it. The distribution of revenues across countries 
has not changed much over the past years to the exception of Australia who has seen its share of revenues 
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increase over the past three years. ‘Dutch vendors’ accounted for 7.8 per cent of all drug revenues, the 
fifth largest country. Few drug listings hid the country they ship from. Listings shipping from regions (e.g. 
from Europe) or from unknown countries only represented about $1,200,000 in drug revenues. It is 
therefore usually possible to determine where drugs are advertised as coming from. 

When comparing revenues per vendor, those operating from Australia appeared to generate most drug 
revenues on cryptomarkets. This is in line with the vastly higher prices of drugs in Australia, which 
probably translates to higher prices per unit. The Netherlands were in sixth place in regards to revenue per 
vendor but had a much higher ratio of vendors per inhabitant than other countries. Netherlands had for 
example 4.5 times more vendors per capita than the United States. 

The ‘Dutch vendors’ mainly list drugs, particularly MDMA, that can be produced inexpensively 
domestically and then resold for higher prices in other countries. ‘Dutch vendors’ were also active in the 
sale of other types of drugs such as ketamine. There was anecdotal evidence that ‘Dutch vendors’ also offer 
listings that ship from outside the Netherlands. In this case, vendors would drive across a border to ship 
from neighbouring countries like Germany. There were also indications that vendors use the Netherlands 
name to increase the perceived quality of their products. 

Little information could be gleaned from sales of drugs on the clear net. There appeared to be hundreds of 
web shops in Europe operating from a range of countries, mostly in the United Kingdom and Poland. 
Only a limited number of shops were operating from the Netherlands. These markets are generating an 
unknown number of revenue. 

The United States and Oceania were the two most common destinations for vendors who specify where 
they are willing to ship to. Europe follows with about $800,000 in drug revenues. All the figures that 
relate to the destination of drugs were difficult to analyse since more than half of all drug revenues have an 
unknown destination. The most common routes for drugs were domestic United States, domestic Europe 
and domestic Oceania transactions. Fiere again, given that incomplete or unknown routes accounted for 
more than a third of all drug revenues, it was difficult to precisely estimate the share of drug shipping 
routes. 

We could fmd little evidence of the demand side for drugs in the Netherlands. Almost no listings were 
posted by ‘Dutch vendors’ that targeted only customers in the Netherlands. The limited number of 
studies that reported on consumers buying drugs online found little to no evidence that Dutch customers 
were using the Internet to buy drugs. 
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In addition to estimating the size of online drug markets, the WODC requested a characterisation of the 
different actors involved in these markets, to feed into the broader understanding of Internet-facilitated 
drugs trade. As such, this section presents an overview of the actors involved in Internet-facilitated drugs 
trade, including their characteristics (age, gender, previous involvement in drug use or trade, etc.) and 
motives (research questions’ cluster D, see Table 1.1). In addition to some general descriptions for various 
roles, two key actors, vendors and buyers, will be described in more detail in subsequent sections since 
more details on these actors were provided in previous studies and interviews. 

This chapter primarily presents an overview of findings from the literature and is complemented by 
interview and case file data. The findings, however, mainly relate to cryptomarkets as evidence for the 
clear net was limited. Several studies identified in our literature review commented on the different actors 
involved in the trade of drugs on the Internet, although it should be noted that these studies were not all 
based on primary, empirical data, but also included references to other studies that focused on these 
actors. Furthermore, most of the studies that reported on characteristics and modus operandi of these 
actors were based on small sample sizes and focused on specific cryptomarkets or countries. Additionally, 
a limitation of collecting primary data from actors on online marketplaces relates to self-reporting bias, as 
those consenting to interviews or other forms of data collection may be the ones that are most positive or 
negative, for example. Following the above, the findings presented in this chapter are not representative of 
all actors on online marketplaces. 

6.1. Overview of actors involved in Internet-facilitated drugs trade 

Based on the literature and case file analysis, five key actors involved in Internet-facilitated drugs trade on 
cryptomarkets were identified. 45 

• Administrator. According to Martin (2014a), the administrator sits ‘at the top of the 
cryptomarket hierarchy’ (also confirmed in the current study’s case file analysis) and within 
this role has ‘full access to the cryptomarket’ (p. 18). The administrator has an executive and 
managing role on the marketplace, is responsible for the policies on the marketplace and 
‘fulfils the role of treasurer with regard to cryptocurrency’ (Van Slobbe 2016, 79; Martin 


45 Less detail on actors on clear net markets were identified in the literature and interviews. While vendors and 
buyers were also mentioned in relation to clear net markets, administrators, developers and moderators were 
mentioned explicitly for cryptomarkets. 
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2014a; LEI5). 46 Administrators receive a commission for each sale finalised through the 
marketplace (Christin 2013; Martin 2014a). Several authors pointed to the libertarian 
ideologies often shared by the actors on these online platforms (Aldridge & Décary-Hétu 
2014; Christin 2013; Maddox et al. 2016; Ormsby 2016; Van Hout & Bingham 2014; Van 
Slobbe 2016). 

• Developer. Developers are primarily responsible for designing the technical infrastructure on 
online drug markets. Details found in the case file analysis showed that the developers were 
all young and IT-skilled males who developed these websites on a freelance basis. 

• Moderator. Generally speaking cryptomarkets have a number of moderators that will manage 
different aspects of the site (LEI5). As Martin (2014a) States, moderators ‘are ranked below 
administrators in the cryptomarket hierarchy and assist with lower-level site maintenance and 
customer support’ (p. 18). 47 As such, the moderator has less access to the infrastructure of the 
marketplace and user information than the administrator (Martin 2014a; Van Slobbe 2016). 
Moderators could receive a salary from the administrators (Martin 2014a). Some technical 
aspects require specific skill sets that admins might advertise for - as Tor does not require the 
individuals to meet directly this work could be managed anonymously (LEI5). 

• Vendor. A vendor sells his or her (illegal) goods to customers through his or her own seller 
page (Martin 2014a). Details on vendor characteristics will be further explained in Section 
6 . 2 . 

• Buyer. Customers on cryptomarkets and vendor shops purchase goods or services on vendors’ 
seller pages, could provide feedback on these purchases and may be involved in discussions on 
forums (Martin 2014a). Characteristics, motives and modus operandi of buyers will be 
further discussed in Section 6.3. 

While the above actors are knowingly involved in online drug markets, previous studies and interviewees 
identified several other actors that (could) have a supporting role in online drug markets (both 
cryptomarkets and the clear net) who may not know their services are used for illicit purposes. These 
actors include bitcoin exchangers, Internet Service Providers, suppliers of legal goods and postal services. 

Firstly, the conversion between flat currencies and virtual ones or from one virtual currency to another 
generally takes place via online bitcoin exchangers. Although most of these services are legitimate, they 
exist as a service within the digital underground economy. Although generally designed for legitimate use 
to offer security to customers, virtual currencies are taken advantage of by cybercriminals as well (Europol 
2014). 

Secondly, Internet Service Providers offer different services to customers (online drug markets in this 
case), including Internet access and hosting domain names (Xfmity.com 2016). Lahaie et al. (2013) found 


46 Martin (2014) provides a detailed description of the actions that fall under these responsibilities: ‘authorising and 
suspending individual accounts; overseeing ‘stealth’ transactions not publicly listed (see Christin 2013); creating new 
product categories; authorising or prohibiting the sale of various items; as well as innovating and implementing new 
security procedures and cyber-defences’ (p. 18). 

1 Responsibilities include: ‘regulating forum discussions; identifying fraudulent activity committed by scammers and 
responding to requests for assistance and complaints from vendors and consumers’ (Martin 2014a, 18). 
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that servers hosting online marketplaces selling NPS ‘are located elsewhere in countries where they can 
escape national regulations and these locations themselves are different from those from where the goods 
are sent’ (p. 3). 48 Lavorgna (2014) similarly found cases of commercial websites being hosted in the 
Netherlands to escape regulations in countries that had ‘more stringent drug laws’ (p. 262). 

Thirdly, based on comments from interviewees on stealth packaging practices, suppliers of legal goods, 
such as envelopes used for stealth packaging, could also (unknowingly) play a role in the online drug 
market. 

Finally, drug couriers, legal courier services or mail services also (deliberately or unknowingly) play a role 
in cryptomarkets given their involvement in delivering the drugs to the buyers’ address (Lavorgna 2014; 
Raeesi 2015; Tzanetakis et al. 2016). 49 Lavorgna (2014) further explained in her article that trusted 
couriers could be used for recruitment of new couriers: ‘online social networks of trusted couriers are used 
to recruit new people by dangling the possibility of undertaking profitable “holidays” in exotic 
destinations’ (p. 252). 

6.2. Vendor characteristics and motives 

6.2.1. Vendor characteristics 

Unsurprisingly, only a limited number of studies reported on characteristics of actors involved in Internet- 
facilitated drugs trade obtained through primary data collection, and these mainly focused on vendors on 
the dark net (Buxton & Bingham, 2015; Ormsby 2016; Van Hout & Bingham 2014). 50 There were no 
empirical studies identified that collected primary data on characteristics on vendors or other actors (not 
including buyers) present on the clear net. There were examples of studies monitoring clear net markets, 
the NPS market in particular, yet they did not specifically examine the characteristics of the actors 
involved (e.g. Corazza et al. 2014; Martinez et al. 2016). 

Van Hout and Bingham (2014) conducted online interviews with vendors (n = 10) on Silk Road, of 
which the majority were male (n = 9), just over half (n = 6) in the age range 30 to 39, just over half (n = 
6) in a form of employment or education and two having attained graduate level education. They 
characterised themselves as ‘intelligent and responsible’ drug consumers for whom the ‘harm reduction 
ethos’ of Silk Road was attractive (Van Hout & Bingham 2014, 186). This finding from previous research 
was supported by data collected in our study: our interviewees also mentioned that common 
characteristics of vendors were: male, young (sometimes students), intelligent, tech-sawy (e.g. EX3, 
EX10, LE11, LEI5). Similarly, the vendors involved in the police case file reviewed for this study were 
male, with age ranging from 20 to 50 and some were educated. Interviewees pointed to a mix of countries 
where vendors primarily seem to operate from the UK, the US, Australia and Germany (EX10, LEI5). 


48 For this particular comment, Lahaie et al. (2013) do not specify whether they refer to marketplaces on the clear 
net or dark net. Based on the context of their report, however, it is likely that they refer to the clear net. 

49 For clear net market places, the involvement of couriers and postal services is also mentioned in reports (e.g. 
Buxton & Bingham 2015; EMCDDAand Europol 2013; Vardakou et al. 2011). 

50 Information on buyer characteristics is explained in Section 6.3.1. 
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Although the dominant language on cryptomarkets is primarily English, some vendors did communicate 
in their native language. 

Additionally, Gwern (2016), an independent researcher, has collected information on arrests in relation 
cryptomarkets dating back to not long after the opening of Silk Road 1.0 in January 2011. Whilst arrests 
are not representative of the vendor population, they do provide some sparse empirical data on individual 
characteristics. Table 6.1 shows that of all 127 vendors arrested in relation to cryptomarkets are 
predominantly male (106 men, 15 women, 6 unknown). Their mean age is 33 years (SD = 10.6). 

Table 6.1. Number of arrests by role and age profile for cryptomarkets, excluding non-drugs 




Female 


Male 

Unknown 

Total 


# 

Mean 

age 

Std dev 

# 

Mean 

age 

Std dev 

# 

# 

Mean 

age 

Std dev 

Buyer 

9 

33.0 

(14.6) 

101 

24.4 

(7.2) 

75 

185 

25.0 

8.0 

Operator 




6 

27.5 

(2.1) 


6 

27.5 

2.1 

Vendor 

15 

35.6 

(13.1) 

106 

33.1 

(10.5) 

6 

127 

33.4 

10.8 

Staff 

1 



9 

36.2 

(12.9) 


10 

36.2 

12.9 

(blank) 




15 

24.0 

(6.0) 

16 

31 

24.0 

6.0 

Total 

25 

34.625 

(13.3) 

237 

28.4 

(9.8) 

97 

359 

28.8 

10.2 

NOTE: age 

when 

arrested; if 

only a range is known, median was selected. Operator refers to 

cryptomarket 


administrator or founder. Staff may include developers and moderators. 

SOURCE: as of 1 2 June 201 6: https://www.awern.net/Black-market%20arrests 

Furthermore, the geographic distribution of arrestees seems broadly consistent with the scraped ‘shipping 
from’ cryptomarket data. Most arrested vendors are from Anglo-saxon and Western European countries, 
with most (35 per cent) from the United States, followed by Sweden (15 per cent), the Netherlands (11 
per cent) and the United Kingdom (10 per cent) (Table 6.2). 
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Table 6.2. Number of arrests for cryptomarkets by role and country, excluding non-drugs 



Buyer 

Operator 

Vendor 

Staff 

Unknown Total 

USA 

99 

2 

44 

4 

6 

155 

New Zealand 

25 

- 

- 

- 

11 

36 

Germany 

9 

- 

7 

1 

12 

29 

UK 

12 

- 

13 

- 

2 

27 

Australia 

18 

- 

5 

1 

- 

24 

Sweden 

- 

- 

19 


- 

19 

Netherlands 

- 

2 

14 

1 

- 

17 

Austria 

6 

- 

2 

- 

- 

8 

Ireland 

- 

- 

7 

1 

- 

8 

Canada 

- 

- 

6 

- 

- 

6 

India 

5 

- 

- 

- 

- 

5 

Norway 

1 

- 

4 

- 

- 

5 

Other 

10 

2 

6 

2 

- 

20 

Total 

185 

6 

127 

10 

31 

359 


NOTE: Operator refers to cryptomarket administrator or founder. Staff may include developers and moderators. 
SOURCE: as of 1 2 June 201 6: https://www.awern.net/Black-market%20arrests 

6.2.2. Vendor motives 

In Van Hout and Bingham’s (2014) research, vendors listed several reasons for commencing selling drugs 
on Silk Road: ‘the lure of vending within an economically viable and secure business channel with high 
volume of site traffic, educated and wealthy customer base, availability of distinctive ethno-botanicals and 
synthetic compounds, pricing profits and capacity to circumvent national legislative Controls was 
attractive’ (Van Hout & Bingham, 2014, 188). Ormsby (2016), an investigative journalist, collected 
stories of hundreds of Silk Road members, including buyers, vendors and staff, through interviews and 
messages via email and secure forums or chats. The vendors primarily reported to be males in the age 
range of 20 to 40, who mainly commenced selling drugs Online based on a Financial motive: ‘personally I 
am completely financially motivated in what I do ... I went through the local Australian listings, did a bit 
of maths and thought “Wow, these guys are paying ridiculous prices for their drugs, there’s definitely 
profit to be made here!” said AussieDomesticDrugs, who sold exclusively to Australian and New Zealand 
buyers’ (Ormsby 2016, 65). Comments on profitability of selling drugs Online were also found in our case 
file analysis and mentioned by some interviewees (EX13, LEI). Bartlett (2015), a journalist who wrote a 
book on his research into the dark net, came up with a rough annual income estimate based on sales data 
of nine medium-size vendors on Silk Road 2.0 between January and April 2014, and concluded that the 
estimate ($60,000—120,000 annually per vendor) suggested that the vendors are ‘more likely middle- 
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market and retailer dealers’ (chapter 5, page not indicated). 51 It should be noted that data collection 
methods were not transparent in Bartlett’s research as his analysis was based on a data file as posted on a 
Silk Road forum by an anonymous Silk Road 2.0 user. As such, these fmdings should be treated 
cautiously. 

For the NPS market, Lahaie et al. (2013) referred to the EMCDDA that reported that ‘the market is 
currently dominated by opportunists who profit from the Internet to promote and sell their products’ (p. 
3). 52 They further noted, however, that Europol reported that ‘the traffic of NPS is sometimes associated 
with that of illegal substances suggesting that criminal organisations may be becoming interested in this 
market’ (p. 3). 

Ormsby (2016) also found that vendors appreciated the absence of meeting buyers in person, as this was 
feit as a safer way of doing business. This was also noted by LE9. Vendors indicated that online sales 
eradicated the potential use of violence, and it gave vendors the option to prioritise the best customers: 
‘not only did dealers have to be wary of customers, who might use violence to rob them of their wares, 
many found that habitual drug users could become irritating when looking for drugs at short notice. They 
knew their dealers’ addresses and their phone numbers and demanded that they be available day and 
night. Silk Road provided them with the opportunity to deal with orders at times convenient to them, 
and to ensure their best customers’ orders were prioritised’ (Ormsby 2016, 65). In their policy brief, 
Buxton and Bingham (2015) described how a vendor feit safer through selling online: ‘the Street market is 
more risky for everyone. I would not want to sell from my house or my car to people face to face where I 
can be identified by several ways. Not only by police but by other rival dealers or gangs. The Street market 
doesn’t have feedback or rating available for every buyer to read. You are more likely to be involved with 
people who might not be concerned in your welfare’ (pp. 10—11). Anecdotal comments as found through 
our case file review, however, also pointed to preferences for selling drugs offline, since fees are applied 
when selling drugs online. 

Finally, several authors pointed to the libertarian ideologies often shared by the actors, not just vendors, 
on these online platforms (Aldridge & Décary-Elétu 2014; Christin 2013; Maddox et al. 2016; Ormsby 
2016; Van Elout & Bingham 2014; Van Slobbe 2016). As one vendor described it, according to Ormsby 
(2016): ‘JesusOfRave claimed that their team did not start selling on Silk Road only because it was a new 
means of doing what they were already doing — selling drugs at a profit — but also because the team fully 
subscribed to the philosophy of the site. ‘This has a large part to do with DPR’s [Dread Pirate Roberts’] 
writings. We feel we share complementary ethics,’ said a representative’ (p. 66). This idea of vendors 
acting from a libertarian view was also shared by some interviewees (e.g. EX3, EX13). Furthermore, EX3 
indicated that there might be a trend from libertarian vendors in the Silk Road 1.0 era to vendors acting 
from a financial incentive. 


51 More information about Bartletfs study can be found in Table Cl. 

52 Again, based on the context in which the information was reported, it is likely that Lahaie et al. (2013) referred to 
the clear net. 
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6.2.3. Previous involvement in offline drugs trade 

There were some, primarily anecdotal comments in the literature on vendors being opportunists and some 
comments about whether these vendors traditionally sold drugs offline and moved to online, or whether it 
was a new group that did not sell drugs previously. In their study of Silk Road vendors, Van Hout and 
Bingham (2014) found that two out of the ten vendors interviewed did not sell drugs online or offline 
previously and none bought drugs online before starting selling drugs on Silk Road. The case file analysis 
confirmed an instance of both offline and online drugs trade. Similarly, Bartlett (2015) commented that 
there were both vendors with previous experience in offline drugs trading as well as vendors who did not 
sell drugs before: ‘some sellers are established middlemen who have been involved in the industry for years 
and have long-standing relationships with importers; they are simply transferring their operations online. 
But Silk Road has brought new people into the marketplace, ranging from Ace, a twenty-four-year-old 
who sold ‘homegrown weed’ on the Silk Road in 2012 — ‘I can take about ten to twenty orders a day, so 
anywhere from seventy to a hundred and forty a week’—to pharmacologists who illegally sell prescription 
drugs from their surgeries’ (chapter 5, page not indicated). A few interviewees also indicated that some 
vendors on online markets did not sell drugs previously (EX3, LE7, LEI5, LE16). A law enforcement 
representative further commented that where arrests were made, actors involved generally did not have 
antecedents and had limited connections to criminal networks (LEI5). 53 One explanation might be the 
ease in which this type of trade can commence, without having a network of contacts in this field, or 
knowledge of the drugs trade since information on acting on cryptomarkets can be found online (LEI 5) 

Ormsby (2016) found that while many vendors on Silk Road were ‘former small-time Street dealers who 
had found a new, lucrative market’, there were also vendors who previously only sold drugs to friends and 
were now able to deal ‘on a more professional level’ (pp. 62—63). With regard to the NPS market, the 
Advisory Council on the Misuse of Drugs (2011) commented that this particular market had vendors that 
did not sell illegal drugs previously, including students. This study, however, did not mention the source 
of this information and as such should be treated with caution. 


6.3. Buyer characteristics, motives and modus operandi 

6.3.1. Buyer characteristics 

Primary research conducted with drug users who purchase drugs on cryptomarkets found that these 
consumers were predominantly male (Barratt et al. 2016a; 2016b; Orsolini et al. 2015 54 ; Van Buskirk et 
al. 2016; Van Hout & Bingham 2013a; 2013b). They were mainly adolescents and young adults (Barratt 
et al. 2016a; 2016b; Orsolini et al. 2015; Van Buskirk et al. 2016), although there were also users in their 
50s and 60s who had rediscovered drugs through Silk Road (Ormsby 2016). These characteristics of 
primarily young and male users were also described by several interviewees (LE2, EX3, EX4, EX6, EX8). 


53 The EU country this comment refers to is left out for confidentiality purposes. 

54 The study by Orsolini et al. (2015) is not primary research as such, yet reports on these studies in their literature 
review. Orsolini et al.’s (2015) review also includes research on online prescription drug customers, yet this is not 
further described in our report. 
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Arrest data also confirmed this. Table 6.1 shows that the vast majority of arrested buyers was male (101 
men, 9 women and 75 unknown) and with a mean age of 25, they tend to be younger than arrested 
vendors. Arrested cryptomarket buyers are concentrated in the United States (99), New Zealand (25), 
Australia (25) and the United Kingdom (18). The absence of the Netherlands may reflect law 
enforcement priority on supply reduction, rather than prosecuting drug users. 

One study conducted among a purposive sample of regular psychostimulant users from Australia found 
that those having bought drugs on cryptomarkets were ‘more likely to be involved in recent property 
crime’ (Van Buskirk et al. 2016, 1). 

In terms of buyer characteristics specifically associated with purchasing NPS online, a review of the 
literature found that age was negatively associated with online purchase of mephedrone, suggesting that 
younger users may lack the necessary financial and other resources (e.g. having a credit or debit card, or a 
safe delivery address) to purchase NPS online (Stephenson & Richardson 2014). 

Silk Road users were based in the United States, the United Kingdom or other parts of Europe, Australia 
and New Zealand (Barratt et al. 2014; United States District Court Southern District of New York 2013, 
as cited in Ormsby 2016). Silk Road users held both left- and right-wing political views (Ormsby, 2016), 
and were often (highly) educated, in tertiary education or professionally employed with disposable income 
(Barratt et al. 2016b; Ormsby, 2016; Orsolini et al. 2015; Van Hout & Bingham, 2013a, as cited in 
Mounteney, Griffiths et al., 2016a; Van Hout & Bingham 2013b). Although mainly based on anecdotal 
evidence or gut feelings, several interviewees confirmed this picture (e.g. EX4, EX6, EX13). 

Aldridge and Décary-Hétu (2014) hypothesised that Silk Road was suitable for recreational users with the 
resources and time to purchase drugs online and wait for deliveries. Indeed, primary research with drug 
users has found that most Silk Road users were recreational drug users who tended to consume drugs on 
the weekend (Ormsby 2016; Van Hout & Bingham 2013b). 55 Given the technological skills needed to 
access drugs on cryptomarkets (Aldridge & Décary-Hétu 2014), online drug customers, perhaps 
unsurprisingly, also tended to be web sawy, technologically literate and knowledgeable about Internet 
security (Ormsby 2016; Orsolini et al. 2015; Van Hout & Bingham 2013b). A few of our interviewees 
also thought that those buying drugs online were IT-sawy, or at least had some IT skills to enter those 
markets (e.g. EX6, EX13, LE15, LE16). Through their research based on interviews with 20 Silk Road 
users, Van Hout and Bingham (2013b) concluded that the need for users to make a conscious decision to 
access Silk Road, to have technical resources and expertise, and be able to wait for a delivery could act as a 
deterrence for impulsive and excessive consumers. This was also reflected upon by our interviewees (EX3, 
EX4, LE14). EX3 and LE14 indicated that those using heroin, for example, might be less willing to wait 
for their drugs to be delivered. Drug users who are unwilling or unable to plan their consumption in 
advance may prefer to purchase drugs from known dealers in person (Aldridge & Décary-Hétu 2016b). 

In terms of drug taking behaviour, some research conducted with Silk Road users found that all had 
consumed drugs prior to using Silk Road (Ormsby 2016; Van Hout & Bingham, 2013b), while other 


55 In their 2014 paper, Aldridge and Décary-Hétu referred to the lack of presence of heroin and crystal meth as 
evidence of this, but their later paper (2016a) involved thorough by-hand cleaning, and found that the amount of 
heroin for sale was not inconsiderable. 
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research with Silk Road users found that there were also users who did not consume drugs previously 
(Barratt et al. 2016b). Our interview data also found that some buyers did not used drugs before or 
bought drugs offline previously (EX6, LE16). Many Silk Road users who were interviewed by Ormsby 
reported using MDMA, psychedelics and cannabis, while a few also purchased heroin and 
methamphetamine (Ormsby 2016). Some users also reported discovering new drugs through Silk Road 
(Ormsby 2016; UNODC 2014). 

Silk Road users self-identified as drug connoisseurs or psychonauts whose drug consumption was based on 
so-called responsible drug consumerism (Van Elout & Bingham 2013a; 2013b; 2014). 56 . EX8 also noted 
that psychonauts bought their drugs online. In a single case study, a Silk Road user reported that he 
preferred to consume drugs alone as there were ‘too many unknowns’ when consuming drugs in a group 
(Van Hout & Bingham 2013a). Other Silk Road users also reported using products alone for 
introspective and psychonautic purposes (Van Hout & Bingham 2013b). Silk Road users also associated 
themselves with a ‘party culture’ (Barratt, 2012), which may be supported by the finding that half of sales 
on Silk Road were for cannabis and ecstasy (Soska & Christin 2015). 

Besides consuming drugs, there is evidence that cryptomarket customers may engage in drug production 
or dealing. Using web-crawling techniques to collect data on drugs sold on Silk Road, Aldridge and 
Décary-Hétu (2014, 2016a) reported that their observed sales of precursors demonstrated that some 
buyers were also illicit drug producers. As mentioned in Section 4.5, Aldridge and Décary-Hétu (2014) 
also reported that high mean purchase prices in the top quintile for each drug on Silk Road suggested that 
some buyers were sourcing wholesale stock for retail purposes, as it was unlikely that buyers purchasing 
drugs for personal use would make purchases in such high amounts. This was also anecdotally confirmed 
by several of our interviewees (e.g. EX1, EX4, EX10, EX13, LE2, LE9, LEI6). Social supply was also 
prevalent, with groups of friends combining resources and to place orders (Ormsby 2016). Such groups 
would spread risk by rotating the delivery address for their order (Ormsby 2016). Additionally, an 
investigative journalist who interviewed Silk Road users over three years reported that buyers tended to 
stockpile their drugs, as they preferred to receive a large volume of drugs in a single delivery, rather than 
receiving a high quantity of deliveries (Ormsby 2016). This was contested by some interviewees, who 
indicated that buyers and vendors try to minimise the risk of detection by shipping smaller quantities of 
drugs (e.g. LEI, LEI6). 

Overall, primary data collection with Silk Road users found that users strove to keep their use of Silk 
Road a secret and tried to protect their anonymity for fear of social stigma, personal security concerns and 
law enforcement action and prosecution (Maddox et al. 2016; Van Hout & Bingham 2013a; Van Hout 
& Bingham 2013b). However, users feit free to engage in discussions about their drug use behaviours 
under the cloak of anonymity, for instance on the Silk Road forum (Maddox et al. 2016). There was a 
positive relationship between online drug information seeking activities and online purchasing of drugs 
(though the type of drugs, and whether purchases took place on the dark web or clear net were not further 
defrned), suggesting that providing and receiving support online, for instance on fora or blogs, may have 


56 According to Van Hout and Bingham (2013b), a psychonaut is ‘a person who intelligently experiments with 
mind-altering Chemicals, sometimes to the extern of taking exact measurements and keeping records of experiences’ 
(p. 526). 
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encouraged potential buyers to make online purchases and consume drugs (Orsolini et al. 2015). Orsolini 
et al. (2015) postulated that the sense of belonging to and participating in a particular group may be 
particularly important for those who are involved in idiosyncratic or unusual drug use, or for those who 
live in remote areas. 

6.3.2. Buyer motives 

In a case study of a single Silk Road user, the participant stated that purchasing illicit drugs on Silk Road 
was perceived as less risky than buying from Street dealers in terms of law enforcement detection and 
personal safety (Van Hout & Bingham 2013a; 2013b). Based on data from a self-selected sample of 
cryptomarket users that completed the Global Drugs Survey in 2014, Barratt et al. (2016a) found that 
‘cryp tornar kets are associated with substantially less threats and violence than alternative market types 
used by cryptomarket customers’ (p. I). 57 The notion on perception of safety on buying drugs online was 
also mentioned by EX3 and LEI6 during interviews conducted for our study. Other primary research 
conducted with Silk Road users found that their main motives for using Silk Road to purchase drugs 
included anonymity (EMCDDA 2015a; Van Hout & Bingham 2013b, as cited in Dolliver, 2015) and 
the ability to minimise the impact on their work and professional status (Orsolini et al. 2015). Moreover, 
the convenience of ordering drugs online (Barratt et al. 2014), alongside the ease of speedy stealth delivery 
of drugs (EMCDDA 2015a; Van Hout & Bingham 2013b, as cited in Dolliver 2015), were cited as 
benefits. 

Analysing data collected as part of the Global Drugs Survey from respondents based in the United 
Kingdom, United States and Australia, Barratt et al. (2014) reported that the main reasons for purchasing 
drugs on Silk Road pertained to having a wider range of and better quality drugs than users would 
normally be able to access. 58 These reasons, as well as price, were also mentioned by a sample of Australian 
drugs users who purchased drugs on cryptomarkets (Van Buskirk et al. 2016). Other primary research 
conducted with Silk Road users found that product variety was also an important reason for purchasing 
drugs on Silk Road (Van Hout & Bingham 2013a; 2013b, as cited in Dolliver, 2015), and this was also 
noted by an interviewee in our study with regard to cryptomarkets in general (LEI6). In their digital 
ethnography of 17 Silk Road users, conducted between 2012 and 2014, Barratt et al. (2016b) described 
how access to a variety of drugs through Silk Road affected the trajectory on drug use for some, with an 
increase in drug purchases in the beginning, and a decrease at later points in time, when buyers had less 
desire to purchase the drugs given the abundance of drug availability online. Some users purchased drugs 
on Silk Road because of the poor quality of Street drugs in their locality (Van Hout & Bingham 2013b, as 
cited in EMCDDA, 2015a). Another commonly cited reason was the ability to purchase drugs from 
highly rated vendors (Barratt et al. 2014). The New Psychoactive Substances Review conducted in the 
United Kingdom reported that drug users who consumed NPS included professionals who wanted to 


57 The authors noted, however, that the sample mainly used closed networks such as friends when cryptomarkets 
were not available, and violence should normally be less common in these networks already (Barratt et al. 2016a). 

58 Bancroft and Reid (2016), who analysed a dark net user forum and conducted interviews with its participants 
found that ‘understandings of product quality depended on [users’] experience, the purpose of use, and [the] context 
[of use]’ (p. 6). For information about the purity of drugs purchased on cryptomarkets, see Caudevilla et al. (2016). 
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evade workplace drug tests or avoid the risk of prosecution (The New Psychoactive Substances Review 
Expert Panel 2014). 

On the other hand, common reasons for not purchasing drugs on Silk Road were having adequate 
existing networks to purchase drugs, fear of law enforcement intervention, and the technicalities involved 
— including accessing the Tor browser, arranging credit and purchasing products (Van Hout & Bingham 
2013b, as cited in EMCDDA, 2015a). 

6.3.3. Modus operandi in buying and receiving of drugs 

Based on an initial review, there were only a few studies identified that collected primary data specifically 
regarding the modus operandi in buying and receiving of drugs. Whilst a description of the mechanisms 
in purchasing and leaving feedback on cryptomarkets is already described in Section 3.1.1, the current 
section focuses on modus operandi in more detail and also includes information on clear net markets. 

Dark net purchases 

As described in 3.1.1, there is a feedback mechanism on cryptomarkets available for buyers to review their 
purchase and service received (Van Slobbe 2016). These feedback mechanisms could be used by buyers to 
make their purchasing decisions. Silk Road users, for example, reported making purchasing decisions 
based on feedback from other buyers, but also took into account pricing, ‘trip reports’ and product details 
on Wikipedia, Erowid, Pubmed, Google Scholar, and vendor reputation (Van Hout & Bingham 2013b). 

Aldridge and Décary-Hétu (2014), using web-crawling methods, observed that buyers left extremely 
positive feedback for listings that included ostensible results of laboratory tests for strength and purity, 
suggesting that buyers are convinced that they are receiving what they have ordered. Indeed, buyers are 
expected to leave feedback on their experiences with vendors, so that any scammers can be discovered and 
removed from the market (Aldridge & Décary-Hétu 2014). A study involving qualitative case studies of 
four online vendors operating on Agora found that buyers provided feedback for vendors on whether the 
stealth method used to conceal the illicit drugs during shipping was satisfactory (Tzanetakis et al. 2016). 

In a study involving online observations and interviews with 20 Silk Road users, participants reported that 
purchases on Silk Road had largely replaced buying from their local Street dealer, though some users relied 
on Street markets, friends and peer networks for drugs while waiting for drugs purchased on Silk Road to 
be delivered (Van Hout & Bingham 2013b). It was not clear, though, if cryptomarkets had changed other 
purchasing behaviours of drug users. For instance, Aldridge and Décary-Hétu (2014) argued that 
cryptomarkets such as Silk Road have led to the internationalisation of markets, as they allowed buyers to 
purchase drugs from vendors around the world, to purchase drugs that are not locally available and to 
shop around for lower prices. However, it appears that buying internationally may not be common — for 
instance, for Australian-based buyers who preferred to purchase drugs from local sellers (Mounteney, 
Griffiths et al. 2016). The same trend was seen in Sweden, according to one of the interviewees in our 
study (LEI6). 
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Clear net purchases 59 

When Controls are imposed on NPS, buyers may stop purchasing the drugs from websites. For instance, 
findings from a self-selected sample of readers who responded to the MixMag dance music magazine 
survey in 2010 and 2011 showed that after the Controls on mephedrone were implemented in the UK, 
there was a shift from buying mephedrone from websites to purchasing from Street dealers (Advisory 
Council on the Misuse of Drugs 2011). However, even prior to the ban, only 33 per cent of respondents 
purchased mephedrone from websites; after the ban, this figure feil to 1 per cent (Advisory Council on the 
Misuse of Drugs 2011). Similarly, a survey of over 1,000 school, college and university students in 
Scotland found that prior to the classification of mephedrone, only 10.7 per cent of users purchased 
mephedrone online (Dargan 2010, as cited in Stephenson & Richardson 2014). 

The role of trust 

One key theme that emerged in the literature review was that, similar to traditional, offline drug markets, 
trust between buyers and vendors is a crucial component in purchasing illicit drugs on online 
marketplaces. The role of trust on online marketplaces was also mentioned by several interviewees (e.g. 
EX6, LEI, LE9). 

Van Elout and Bingham described the relationship between vendors and buyers as being characterised by 
trust and professionalism (Van Elout & Bingham 2013a, as cited in Tzanetakis et al. 2016). It is 
considered important to build and maintain a good reputation as a buyer or vendor (e.g. Bartlett 2014) 
via feedback from other parties. This is highlighted by Aldridge and Décary-Elétu (2014), who 
commented that in the world of the drugs cryptomarket, having a good reputation ‘may be more 
important than muscles and face-to-face connections’ (Aldridge & Décary-Elétu 2014, 16; the importance 
of reputation was also mentioned by EX18). Aldridge and Askew (2016) have analysed how drug vendors 
engender trust particularly in novice cryptomarket buyers in the way they ‘advertise’ their products and 
services on drug cryptomarkets and convey a sense of themselves as ‘reliable transactors’, particularly given 
the ever-present possibility of scams on both sides of the transaction. These vendor-written texts function 
as service and product quality indicators, which, alongside marketplace regulatory features, have been 
suggested to reduce the information imperfections typically thought to characterise illegal marketplaces 
(Aldridge et al. 2016), making cryptomarkets resemble legal marketplaces in some key dements. 

Buyers on cryptomarkets appear to develop strong relationships with sellers. An investigative journalist 
who interviewed Silk Road users over three years found that following the closure of Silk Road, users 
simply migrated to alternative markets (Sheep and Black Market Reloaded) where they could verify that 
they were working with the same vendors as before through the use of encrypted signatures (Ormsby 
2016). Other users who had formed relationships with their favourite vendors responded to the Silk Road 
seizure by bypassing the cryptomarket and conducting subsequent transactions via secured email (Ormsby 
2016). A similar practice was also noticed by LE9, who indicated that establishing mutual trust was 
paramount to facilitating transactions. Once such trust has been established, vendors and buyers may scale 
up the number of transactions and the volumes through other communication channels (LE9). 


59 The articles used in this section refer to NPS sold on ‘websites’, yet do not specify for clear net or cryptomarkets. 
However, given the context of these studies it is highly likely that ‘websites’ refer to clear net websites. 
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Where a vendor has established a trustworthy reputation through previous sales and positive feedback, 
customers were reportedly willing to accept early fmalisation (Tzanetakis et al., 2016). Tzanetakis et al. 
(2016) argued that vendors who have increased their reputation through building up trust with existing 
buyers were also subsequently able to attract new customers, as the trust reduces buyers’ perception of the 
risk of purchasing illicit drugs from a stranger on the dark net (Tzanetakis et al. 2016). A study employing 
systematic online observations and interviews with 20 Silk Road users found that buyers’ experience of 
several successful transactions and quality products appeared to positively affect their loyalty to certain 
vendors (Van Hout & Bingham 2013b). Conversely, some buyers reported that with unknown vendors 
they would initially purchase small amounts of illicit drugs to sample (Van Hout & Bingham 2013b). 

Besides providing feedback on cryptomarkets, buyers were also able to submit reviews on vendors on 
Subreddits - categories on reddit.com - such as Agora and DarkNetMarkets, which other users could 
then comment on (Tzanetakis et al. 2016). While the level of detail of these reviews varies, they were 
typically more detailed than the feedback submitted on vendors’ profile pages (Tzanetakis et al. 2016). 

In sum, emerging evidence on the role of trust in online marketplaces shows that there were different ways 
in which both vendors and buyers signal and establish trust online. 


6.4. In sum 

There is consensus in previous literature and interviews and case file analysis that five key actors are 
knowingly involved in cryptomarkets: administrators (executive management and treasurer), developers 
(web design and maintenance), moderators (staff members on the marketplace), and finally, vendors and 
buyers selling and purchasing on these marketplaces respectively (the latter two also identified in data on 
clear net markets). Additionally, there is agreement that others (could) have supporting roles, some 
knowingly and others unknowingly: bitcoin exchangers, Internet Service Providers, suppliers of legal 
goods and postal services. This chapter described two of these actors, vendors and buyers, in more detail. 

Based on limited, sometimes anecdotal, evidence from the literature, interviews and case file analysis, the 
characteristics, motives of vendors and characteristics, motives and modus operandi of buyers was 
explored. These findings primarily related to cryptomarkets as evidence for the clear net was limited. 
Furthermore, most of the studies that reported on characteristics and modus operandi of these actors were 
based on small sample sizes and focused on specific cryptomarkets or countries. As such, these findings are 
not representative for all actors on online marketplaces. However, based on these limited studies, some 
common findings were identified. 

One common finding across studies and interviewees was that vendors were relatively young (under the 
age of 40), educated and entrepreneurial men with strong IT-skills. Broadly consistent with our scraped 
cryptomarket data, they mainly came from Anglo-Saxon or Western European countries. Additionally, 
some were both vendors as well as buyers (consumers) of drugs. Furthermore, anecdotal evidence showed 
a mix of vendors who already had established offline drugs trade businesses and vendors who never sold 
drugs previously. Vendors were attracted to sell drug online for various reasons, including financial 
motives, libertarian ideologies and the feeling of personal safety on online platforms. 
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Similarly, buyers were relatively young, educated and tech-sawy males from Anglo-Saxon and (other) 
European countries. These were mainly recreational drug users (some considered themselves 
‘psychonauts’) who used drugs previously. The latter was however contested by some anecdotal evidence 
from interviews. Moreover, it was found that while for some buyers a cryptomarket replaced buying from 
their local dealer entirely, for others they still relied on other, offline avenues as welk Similar to our 
cryptomarket data on wholesale, previous research found that most buyers purchased quantities for 
personal use, but some buyers also bought larger quantities for retail purposes or social supply. In 
addition, some buyers bought precursors for illicit drug production. Motives for buying drugs Online 
primarily included perceptions of increased safety when buying Online, quality and product variety drugs 
available online, anonymity and the ease of speedy stealth delivery. There was limited primary research on 
the modus operandi of buying drugs online. Buyers reported to make purchases based on pricing, 
reviewing ‘trip reports’, products details on websites such as Wikipedia, vendor reputation and feedback 
from other buyers. The latter, leaving feedback, was expected from buyers who purchased drugs on 
cryptomarkets. It was also found that the role of trust between vendors and buyers is a key component in 
purchasing drugs online — an element that is also identified in offline drug markets - and there are 
different ways in which both vendors and buyers signal and establish trust online. 

Finally, for both buyers and vendors, and as reflected in other work (e.g. Trautmann 2016), there is 
currently insufficiënt evidence to make statements on whether the presence of online drug markets leads 
to new actors that previously would not have sold or bought drugs offline, or whether the offline market is 
substituted by online markets. 
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7. Detection and intervention of Internet-facilitated drugs trade 


Law enforcement is one of three pillars of Dutch drugs policy, alongside prevention and harm reduction. 
There have been several law enforcement investigations in the field of Internet-facilitated drugs trade in 
the Netherlands (see Box 7.1). Some of these have led to arrests and convictions. This chapter provides an 
overview of potential modes for detection and intervention in the Netherlands and other countries. As 
such, this study takes stock of the practices that are currently being deployed, or they could potentially, in 
the Dutch and international context (research questions’ cluster D, see Table 1.1). 

Based on findings from in-depth interviews with Dutch and foreign law enforcement experts and 
complemented by literature data, different strategies were identified and verified with Dutch focus group 
participants. These strategies, and their possible barriers, are outlined in this chapter. 

7.1. Scope of this chapter 

There are a few notes of caution that should be taken into account when reading this chapter. Firstly, this 
study only aimed to provide a high level overview of strategies and their related barriers as identified by 
interviewees or in the literature, and is not intended to provide a comprehensive mapping of all strategies. 
Secondly, Internet-facilitated drugs trade is still a relatively new and continuously evolving phenomenon, 
and the same goes for responses to this phenomenon by Dutch and international law enforcement 
agencies. Accordingly, strategies may not be fully developed yet. In addition, while it is recognised that 
Internet-facilitated drugs trade crosses borders, approaches to detection and investigation deployed in 
other countries might not be directly applicable to the Dutch context. Moreover, and perhaps 
unsurprisingly, the majority of law enforcement interviewees indicated they were not allowed to comment 
on the details of the strategies used, as this might be used by actors involved on these marketplaces to 
avoid detection. Therefore, these findings are based on limited interview data. Similarly, it is likely that 
for the same reason, the identified studies did not report on sensitive data. As such, the strategies and their 
barriers discussed in this chapter may not be exhaustive. Following the caveats mentioned here, this study 
did not aim to provide recommendations for Dutch law enforcement organisations, but merely aimed to 
provide an overview of some existing (or proposed) strategies. 

Furthermore, while most of the findings relate to cryp tornar kets, some of these avenues could also be used 
for tackling Internet-facilitated drugs trade on the clear net. Focus group participants, however, indicated 
that this currently has low priority for law enforcement. 

Finally, some authors and interviewees (e.g. Martin 2014b; EX3, EX4) argued that the existence of online 
drug marketplaces might actually be a safer option for the different actors involved compared to offline 
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drugs trade, and that as such, intervention in these online marketplaces might not be the preferred 
approach. However, since the aim of this study was to identify possibilities for detection and intervention, 
this study did not report on other possible strategies. 

7.2. Four modes of detection and intervention 

Findings from the in-depth interviews and the literature review suggested four separate strategies that are 
or can be used in the detection and intervention of the Internet-facilitated drugs trade. These strategies 
were presented to and verified with Dutch law enforcement experts and other experts during the focus 
group as held during the final phases of this study. 

These verified strategies are outlined below and further described in the following sections: 

1. Traditional investigation techniques applied in the drug chain; 

2. Postal detection and interception; 

3. Online detection; and 

4. Online disruption. 

In earlier work, Christin (2013) already suggested four possible intervention strategies to disrupt Silk 
Road operations: disrupting the network, disrupting the financial infrastructure, disrupting the delivery 
model, and laissez-faire. The First strategy involved disrupting the Tor network, which Christin (2013) 
acknowledged would be difficult to implement. The second strategy involved capitalising on bitcoin’s 
volatility by manipulating the currency, or de-anonymising bitcoin users. The third strategy involved 
increasing Controls at the post office or at customs to seize drug shipments. The last strategy involved non- 
intervention based on a drug abuse prevention approach, compared to enforcing drug prohibition 
(Christin 2013). 

7.2. 7 . Traditional investigation techniques applied in the drug chain 

Mounteney, Griffiths et al. (2016) highlighted that although sales activities for Internet-facilitated drugs 
trade take place online, there are still physical components in cultivating, producing, and distributing the 
drugs. Traditional investigation techniques, such as physical observation and undercover operations, 
exploit the weak links in the chain where the digital and offline worlds meet (the ‘Achilles’ heel’ of 
vendors, LEI). The use of traditional investigation techniques was also raised by several Dutch 
interviewees and confirmed by focus group participants (e.g. EX13, LEI, LE2, Focus Group). Examples 
of points where the digital and offline worlds meet include when drugs are sent via postal services or 
where money laundering (through actors such as bitcoin exchangers) is involved. With regard to the 
latter, and according to the Dutch public prosecution office, Internet-facilitated drugs trade ‘increases 
demand for anonymous bitcoin exchange, a practice that allows for the deployment of rigorous 
investigation methods’ (Kooistra & Trommelen 2014, no page) 60 . This was also confirmed during the 
focus group, where it was indicated that in the case of this exchange taking place offline, techniques like 


60 Freely translated from Dutch: “De onlinekandel leidt volgens Justitie ook tot een grote vraag naar anonieme inwisseling 
van bitcoins naar normale valuta, waarop goede recherche mogelijk is.” (Kooistra & Trommelen 2014, no page). 
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physical observation could be placed on the bitcoin exchanger in order to capture the exchange taking 
place. 

As such, traditional investigation approaches including surveillance and using undercover law 
enforcement officers can be used to disrupt online marketplaces (e.g. LEI, LE2, LE9, LE13). Buxton and 
Bingham (2015) reported that to date, law enforcement responses to cryptomarkets have relied on 
traditional strategies of surveillance, interdiction and prosecution, using techniques including informants, 
undercover surveillance and tracking. Finklea (2015) cited another example of law enforcement collecting 
personal data about users on a forum about cryptomarkets by issuing a subpoena to Reddit. On this 
forum, topics like online drugs sales were discussed. Finklea (2015) however warned that such law 
enforcement strategies may eventually drive users to anonymous forums such as those on Tor. 

Barriers to traditional investigation techniques applied in the drug chain 

The use of traditional law enforcement techniques has limitations in tackling Internet-facilitated drugs 
trade. One limitation is the potential imbalance between the costs and benefits of using traditional 
investigation methods. For instance, Martin (2014b) highlighted that it is expensive and invasive to 
conduct undercover and surveillance operations on suspected drug buyers, while most buyers are likely to 
purchase only small amounts of drugs. In addition, in the offline world, using such means to target buyers 
may be easier to justify if buyers can be compelled to provide information about their suppliers, enabling 
law enforcement to target the supply chain. Flowever, users who purchase their drugs on the Internet or 
cryptomarkets are unlikely to be able to provide identifying information or evidence about vendors 
(Martin 2014b). A barrier relating to focusing on bitcoin exchangers, as mentioned by focus group 
participants, involves the fact that dealing in bitcoins as such is not illegal under Dutch law, which makes 
money-laundering investigations difficult. Furthermore, money tends to flow through foreign banks and 
bitcoin exchangers, which limits intervening in these practices. 

7.2.2. Postal detection and interception 

As mentioned in the previous section, the delivery process presents a key opportunity for law enforcement 
detection and intervention of Internet-facilitated drugs trade (e.g. LEI, LE2, LE16, Focus Group). As 
Barratt (2012) stated, ‘at the end of the transaction, the physical product still needs to be sent to the 
buyer’. To increase the odds of intercepting drug deliveries, the 2013 EU Drug Markets Reports 
suggested that it will be necessary to simultaneously raise awareness and increase vigilance among postal 
and courier services (EMCDDA & Europol, 2013), while Van Slobbe (2016) suggested professionalising 
checks on parcel post. These measures would require collaboration with parcel services and using 
advanced screening techniques. Examples include using track and tracé information - used by sending 
and receiving parties to follow progress of shipments — as obtained from post offices and surveillance at 
post offices (LEI). An example from a European country as mentioned by LE11 involved a case whereby 
undercover law enforcement officials bought drugs on a cryptomarket, and traced the vendor as his return 
address was included on the parcel. 

Dutch interviewees were positive about collaboration between law enforcement agencies and postal 
services (LE5, Focus Group). From September 2016 onwards there will be a so-called ‘post team’, 
consisting of six parties such as police, postal service and customs, who will focus on collecting 
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information these shipping practices and thinking about potential barriers that can be put up in the chain 
(Focus Group). 

Barriers to postal detection and interception 

The process of shipping goods between countries provides law enforcement with the opportunity to detect 
and intercept illicit drugs (Barratt 2012; Martin 2014b), but legal restrictions related to secrecy of 
correspondence in the Netherlands may be a barrier to introducing more stringent screening of parcels. 
Additionally, Martin (2014b) highlighted four problems with the strategy of postal detection and 
interception. First, the expanding volume of international trade places a large burden on the limited 
resources of customs agencies (also mentioned by LEI). According to Martin (2014b), customs officers 
are therefore increasingly forced to concentrate on postal items that appear highly suspicious instead of 
going through all items. Second, vendors use highly sophisticated concealment techniques in shipping 
drugs, and discussion forums are constantly updated with information on how to successfully avoid 
detection. One technique as mentioned by several interviewees is to avoid shipping from the Netherlands 
altogether, since these parcels tend to be picked up by foreign customs (outside the EU), for example by 
sending the parcel from Germany (e.g. EX3, LEI, LE9, LE16). A related issue is the internal market in 
the EU, in which mail and parcels sent within the EU are generally not checked (LE11, LEI4). Martin 
(2014b) further noted that buyers are provided with information on how to frustrate law enforcement 
methods by using false names and addresses. Third, moreover, drugs are often bought in small quantities, 
which mean that they can be shipped in regular, inconspicuous envelopes (Martin 2014b). Finally, the 
feedback system helps to ensure that vendors who use effective concealment methods are rated more 
highly and are consequently rewarded with increased business (Martin 2014b). 

7.2.3. Online detection and monitoring 

Online detection employs various strategies to de-anonymise players involved in Internet-facilitated drugs 
trade (e.g. LE11). For instance, in order to identify vendors, Van Slobbe (2016) proposed that law 
enforcement should invest in big data techniques to link aliases and Internet activity with IP addresses. 
Combining different data sources, tools and techniques using big data analytics and machine learning 
could be deployed to connect different data sources and eventually de-anonymise cryptomarket actors. At 
the time this study was conducted, we were not aware of these techniques already being deployed for these 
purposes (i.e. de-anonymisation of cryptomarket actors). While we do not discuss these techniques in 
detail here given the scope of this study, note that the development and use of these techniques would 
require investments in capacity, infrastructure and skills. 

Continuous, proactive (automatic or manual) monitoring of Online marketplaces was also mentioned in 
the literature and by interviewees as a preferred method (e.g. EMCDDA 2015a; EMCDDA and Europol 
2013; Lavorgna 2016; LEI, LE5, LE9, Focus Group). 

Another method of identifying individuals is to ‘follow the money’ - in other words, to track money flows 
in the drugs trade in order to identify the individuals involved. Indeed, Villasenor, Monk and Bronk 
(2011) suggested that government agencies should keep abreast of new and emerging money transfer 
methods (as cited in Steward 2013), and Europol’s Internet Organised Crime Threat Assessment 
highlighted that investigative action against the criminal use of cryptocurrencies must be prioritised in 
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order to tackle the abuse of anonymity in virtual currency schemes (Europol 2014). This method may be 
employed with cryptocurrencies, such as bitcoin. As bitcoin (or other cryptocurrencies) purchases must be 
made from established, legitimate bitcoin vendors, and generate corresponding official fmancial records, 
law enforcement agencies can also conduct ‘block chain analyses’ to identify users by monitoring and 
tracking bitcoin transactions (Ciancaglini et al. 2016; Cox 2016b; Martin 2014b). However, due to, 
among others, the dynamic landscape of cryptocurrencies, block chain analysis is a complex process and 
requires a resources-intensive approach. Villasenor, Monk and Bronk (2011) suggested that governments 
should establish partnerships with private sector entities, such as mobile money transfer platforms and 
banks, to track money flows (as cited in Steward 2013). Focus group participants confirmed collaboration 
with Dutch banks to spot inexplicable Capital. 

Barriers to online detection and monitoring 

In addition to limitations regarding the capacity, resources and capabilities to undertake online detection 
strategies in the Netherlands (as discussed in Section 7.2), several challenges were identified in the 
literature. 

Ciancaglini et al. (2015) listed three challenges to law enforcement related to online detection: 
encryption, attribution and fluctuation. First, Ciancaglini et al. (2015) noted that due to encryption on 
cryptomarkets, even if law enforcement was able to seize a cryptomarket’s servers, officers would not 
necessarily be able to identify customers, vendors, or where illicit drugs are being sent (Cox 2016b; 
Martin 2014b). Interviewees (FE9, FE15) also pointed to the issue of encryption, for example around 
confiscating encrypted servers (FE9). Second, it is difficult to attribute activity to individuals because all 
activity takes place on .onion domains and routing to the domains is not clear (Ciancaglini et al., 2015). 
Third, Ciancaglini et al. (2015) stated that the deep web is extremely dynamic, with frequent changes to 
naming and address schemes. In addition, and as further elaborated on in the next section, the actors on 
these marketplaces are also dynamic. The dynamic nature of online marketplaces means that in order to 
document and successfully prosecute crimes, law enforcement officers must be able to rigorously 
document illegal activity (Ciancaglini et al. 2015). In addition, and although referring to cyber- 
investigations more broadly, Koops and Goodwin (2014) argued that digital evidence (compared to 
physical evidence) is more vulnerable to manipulation and removal. 

Furthermore, as indicated by several law enforcement interviewees, there are still considerable legal 
barriers to online detection and monitoring, restricting the competencies of the police. Introduction of 
the proposed bill for the Dutch Act on Cybercrime III (Wetsvoorstel Computercriminaliteit III) aiming to 
amend the law on cybercrime and includes, among others, will offer investigative authorities the authority 
to access computers from a distance (to block access to data, or to conduct surveillance, for example) 
(Buwalda & Kwakman 2014; Rijksoverheid 2015). While increased legal possibilities may expand the 
surveillance competencies and there enhance effectiveness of law enforcement, there will be inherent 
trade-offs with privacy protection and Internet freedom. 

Finally, Martin (2014b) noted that bitcoin is increasingly used for legitimate purposes, which means that 
individuals who trade in bitcoin may not necessarily be engaging in criminal activity, something that was 
also pointed out by focus group participants. 
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7.2.4. Online disruption 

Closely linked to online detection, online disrupdon involves reducing the trust around anonymity and 
the reliability of cryptomarkets (EMCDDA 2015a; Mounteney 2016b; Van Slobbe 2016), as well as 
identifying, arresting and prosecuting vendors (EMCDDA 2015a; Mounteney 2016b). In practical terms, 
law enforcement officers may work to diminish trust through undercover or covert operations and 
infiltrating online markets (EMCDDA 2015a; Mounteney 2016b), also known as ‘lemonising’ the 
market (Franklin et al. (2007, as cited in Eloe et al. 2012), The underlying assumption is that removing 
the anonymity of buyers and sellers would make online marketplaces less attractive to use (Van Slobbe 
2016). 

As part of online disruption, law enforcement may also attempt to disrupt the market using high profile 
‘takedowns’ (e.g. Buxton & Bingham 2015; EMCDDA 2015a; Mounteney 2016b; LE9, LEI5). 
Examples of takedowns are Operation Onymous and Commodore (see Box 7.1). Ensuring that these 
takedowns receive media attention is intended to make individuals aware of police presence and thus can 
act as a deterrent (EMCDDA 2015a; Mounteney 2016b). Elutchings et al. (2016), who conducted 
interviews with 24 stakeholders — including law enforcement officials — involved in website (not just 
cryptomarkets) takedowns, found several reasons to take down websites, of which one related to 
discouraging motivated offenders. The authors noted that Torum and marketplace takedowns done in 
tandem with other law enforcement activities may reduce the presence of motivated offenders by 
decreasing trust in reappearing websites’ (Elutchings et al. 2016, 6). Accompanying a takedown with 
arrests could have the effect of increasing ‘the perceived risk of being detected and prosecuted’ (Elutchings 
et al. 2016, 6). The above mentioned techniques on online disruption, however, might depend on the 
legal possibilities available in a country. 
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Box 7.1. Examples of law enforcement interventions 


61 


Operation Onymous was an internationally coordinated police operation led by the FBI in the United States and 
involving authorities in 21 countries (Europol 2015). On 5 November 2014, the FBI, together with the U.S. Drug 
Enforcement Administration, Homeland Security Investigations, and European law enforcement agencies acting 
through Europol and Eurojust, shut down multiple marketplaces including Silk Road 2.0, Cloud 9, Hydra, Pandora, 
Blue Sky and Black Market (Aldridge & Décary-Hétu 201 6; Buxton & Bingham 201 5; Dolliver 201 5; Van Slobbe 
2016). Operation Onymous also shut down money laundering websites including Cash Machine, Cash Flow, 
Golden Nugget and Fast Cash (Van Slobbe 201 6). The authorities were able to seize 61 9 .onion domains, 
bitcoins worth €900,000 and €1 80,000 at the time, and drugs, gold and silver (Europol 2015), and made arrests 
of 1 7 individuals in 1 7 countries, including the alleged operator of Silk Road 2.0, Blake Benthall (Aldridge & 
Décary-Hétu 201 6; Dolliver 201 5). What was reportedly unique about Operation Onymous was that it involved an 
undercover agent who had been working as an administrator on Silk Road 2.0 since the market emerged, 
highlighting that anonymity can both support and undermine the Internet-facilitated drugs trade (Aldridge & Décary- 
Hétu 2016). 

Operation Commodore was an undercover operation conducted by the Dutch and German police in 2013 and 
2014 (Security.nl 2014). Undercover activities included the Online purchase of drugs and weapons. Law 
enforcement authorities took down a marketplace called Utopia, and seized, among others, 900 bitcoins (worth 
€400,000 at the time) from the suspects involved. The German police also seized servers in Bochum and 
Düsseldorf, while the Dutch police arrested several Dutch citizens (Security.nl 2014). 


Barriers to online disruption 

The main barrier to online disruption is the speed at which buyers, sellers and administrators are able to 
adapt to cryptomarket takedowns (EMCDDA 2015a). It appears that marketplace takedowns have had 
little long-term impact (Buxton & Bingham 2015; Ormsby 2016; Tzanetakis et al. 2016). Impacts of the 
closure of the original Silk Road and Operation Onymous included an increase in the prices of illegal 
goods (Europol 2015), a temporary fall in the value of bitcoin (Buxton & Bingham 2015; Van Buskirk et 
al. 2014), and an increase in the market share and price of cannabis (potentially because the penalty for 
buying and selling cannabis was lower compared to other drugs) (Soska & Christin 2015). Box 7.2 further 
elaborates on the possible consequences of taking down online marketplaces. 


61 Between February 2015 and January 2017, another European initiative has been taking place, called the ‘Joint 
investigation to combat drug trafficking via the virtual market (darknet) within and also into the EU (JICDT-VM)’. 
It is led by the Austrian Federal Criminal Police Office with support from Germany and aims to ‘form operational 
criminal intelligence networks and to carry out investigations in virtual marketplaces on the Internet, focused on 
combatting international drug trafficking in connection with cybercrime’ (Federal Ministry of the Interior 2015). 
Other parties involved include: all Member States, Europol, Eurojust, Interpol, EMCDDA, the European 
Commission and the UNODC. 
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Box 7.2. Possible consequences of taking down online marketplaces 


Displacement to existing marketplaces 

The main consequence of bringing down marketplaces has been the migration of vendors and customers to other 
existing markets (Digital Citizens Alliance 2014a; Mounteney, Griffiths et al. 2016; Ormsby 2016; Soska & 
Christin 2015; Van Buskirk et al. 2014). For instance, within weeks of Ross Ulbricht's arrest and the takedown of 
Silk Road 1.0 in October 201 3, both Black Market Reloaded and Sheep Marketplace experienced drastic growth 
(Buxton & Bingham 2015; Digital Citizens Alliance 2014a). Both marketplaces provided a mechanism for verifying 
Silk Road vendors, which encouraged customers to migrate along with the vendors (Buxton & Bingham 2015; 
Ormsby 201 6). Following the takedown of Silk Road, a new Finnish marketplace also emerged on the deep web to 
cater for customers based in Finland (Mounteney, Griffiths et al. 2016). Subsequently, Operation Onymous, 
conducted in November 2014, resulted in the displacement of vendors and customers to the remaining 
marketplaces, including Agora and Evolution (Europol 2015; Soska & Christin 2015). The closure of Evolution in 
March 2015 following an exit scam also displaced vendors and customers to Agora, and smaller markets such as 
Abraxas, AlphaBay, Black Bank and Middle Earth (Europol 2015). 

Development of new marketplaces 

The takedown of marketplaces has also led to the development of new marketplaces. For instance, Silk Road 2.0 
was launched about one month after the closure of the original Silk Road (Buxton & Bingham 2015; Digital 
Citizens Alliance 2014a; Hutchings et al. 201 6; Soska & Christin 2015; Van Slobbe 2016). Other marketplaces 
following the same model of offering an online platform for vendors and customers to interact also emerged (Buxton 
& Bingham 201 5; Europol 201 5; Soska & Chrisin 201 5; Van Slobbe 2016). As Buxton and Bingham (2015) 
noted: 'According to Mike Power, arrests and the closure of Silk Road version: Has inadvertently been the most 
brilliant advertising for hidden web drug markets. The FBI have acted as the most Creative marketing and 
advertising agency that the hidden web drugs sector could have possibly have hoped for' (p. 14). 

In addition, law enforcement takedowns have also encouraged the development of new security and technical 
features (Buxton & Bingham 2015; Mounteney, Griffiths et al. 2016a; Ormsby 2016; Van Slobbe 2016). For 
instance, some markets will only admit new members who have received an invitation from an existing member 
(Mounteney, Griffiths et al. 201 6; Van Slobbe 2016). Cryptomarkets are increasingly using more covert 
communication and advanced encryption techniques (Mounteney, Griffiths et al. 201 6). Decentralised, open 
source, markets have also developed to combatfuture marketplace takedowns (Buxton & Bingham 2015; Ormsby 
2016). 


Use of other methods of trading 

In the wake of the shutdown of the original Silk Road, some customers reported that they would return to traditional 
methods of purchasing drugs (Ormsby 201 6). Other users resorted to bypassing the cryptomarkets entirely by 
transacting directly with their favourite suppliers via secured email (Ormsby 2016). 


Impact on trust in the marketplace 

Same argue that law enforcement actions and scams have potentially resulted in a loss of confidence in 
cryptomarket platforms, which may limit the future growth of the drug cryptomarket (Aldridge & Décary-Hétu 201 6; 
Europol 201 5; Maddox et al. 201 6). However, others have suggested that trust and confidence have not been 
significantly diminished or are quickly restored (Soska & Christin 2015; Van Buskirk et al. 2014). Users have also 
reported that the closure of the original Silk Road did not diminish their desire to exercise their personal freedoms, 
for instance through using other marketplaces on the dark web (Maddox et al. 201 6). 

It has also been suggested that the negative impact of scams on trust within the market (Digital Citizens Alliance 
2014a; Soska & Christin 201 5) was greater than what law enforcement action could achieve (Europol 2015). 
Compared to law enforcement crackdowns, scams also had a larger impact on the longevity of cryptomarkets 
(Aldridge & Décary-Hétu 201 6), undermining the overall impact of law enforcement takedowns. 
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7.3. Lessons for detection and intervention of Internet-facilitated drugs 
trade 

Based on findings from the in-depth interviews, focus group and the literature, two cross-cutting, key 
dements were identified that could play a facilitating role in applying the four strategies in detection and 
intervention of Internet-facilitated drugs trade. 

Firstly, since Internet-facilitated drugs trade crosses borders, it was noted by both interviewees and in the 
literature that international cooperation and coordination is key in tackling Internet-facilitated drugs 
trade (e.g. Europol 2014; Europol & EMCDDA 2013; LE2, LE11, LE15). Previous and current 
examples of internationally coordinated projects include Project ITOM (Illegal Trade on Online 
Marketplaces) and Project EMPACT (an EU-wide police project including 22 countries and focusing on 
- among many other subjects - tackling cryptomarkets). 62 Law enforcement cooperation between 
countries is, of course challenging. Joint law enforcement interventions could require mutual legal 
assistance requests given the involvement of different jurisdictions (fiutchings et al. 2016; LE17). 
Furthermore, there are legal challenges involved in tackling this phenomenon that crosses borders, for 
example when the legality of substances sold online differs per country (Trautmann 2016, 9). 

Secondly, key barriers to online detection are capacity and resources to undertake this, and the 
(technical) capabilities of law enforcement officials to tackle Internet-facilitated drugs trade. This point 
was also raised by several Dutch interviewees and participants of the focus group (e.g. LEI, LE14, Focus 
Group). Interventions such as online detection and disruption are time-consuming and require a certain 
level of technical (and sometimes financial) skills. There have been, however, developments in this field, as 
a dedicated ‘Dark Web Team’ at the Dutch police was recently established. This team aims to monitor 
developments in the field of Internet-facilitated drugs trade. In addition, Interpol, together with the 
Netherlands Organisation for Applied Scientific Research (TNO), hosted a dark net training course in the 
summer of 2015, in which law enforcement representatives from several countries (including the 
Netherlands) had the opportunity to participate in a simulated online marketplace (Interpol 2015). 

In sum, international cooperation and coordination (and the accompanying legal challenges), capacity and 
resources, and (technical) capabilities could play a facilitating role in deploying the different strategies to 
tackle Internet-facilitated drugs trade. 


62 EMPACT is the European Multidisciplinary Platform against Criminal Threats. EMPACT is a platform 
administered by Europol, supporting law enforcement and other practitioners involved in the implementation of the 
EU Organised Crime Policy Cycle. The Policy Cycle includes Drugs (cocaine and heroin), and Cybercrime as 
priority areas (Council of the European Union 2010). 
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8. Conclusions 


In this chapter we revisit the research questions set out for this study and synthesise the fmdings for each 
of them based on the evidence collected presented in previous chapters. Limitations to our approach, 
described in Chapter 2, should be borne in mind when considering our responses to the research 
questions. Before answering the research questions in detail, we draw some general conclusions. 

Overall, we found that - similar to many markets for licit goods and services - the Internet has created 
new business models for drugs trade. On the hidden or dark web, so-called cryptomarkets and vendor 
shops, accessible through encryption software, bring together vendors and buyers for illegal goods and 
substances, mostly illicit drugs. Cryptomarkets quickly gained popularity between 2011 and 2013 with 
the rise and fall of Silk Road 1.0. A month before it was taken down by the FBI, researchers estimated 
monthly revenues for drugs trade on Silk Road at more than $7m. 

Drugs trade via cryptomarkets has shown to be resilient to law enforcement intervention and distortion, 
as new market places quickly emerged and gained market share. At the moment, there are purportedly 
about 50 cryptomarkets and vendors shops on the dark web. Since the heyday of Silk Road 1.0 in 2013, 
however, we conclude that the evolution of drugs trade via cryptomarkets is one of incremental change, 
rather than explosive. Revenues have about doubled since then, and the total number of transactions has 
tripled. There is also some continuity in the market share of different drug types and the proportion that 
can be labelled as Wholesale. 

But despite considerable challenges, such as declining trust due to scams and law enforcement take downs, 
cryptomarkets have survived. Yet, they represent a niche of drugs trade at large, as they constitute a 
fraction of the total drug market in the offline world. Whereas the total retail value of the European drug 
market is estimated at a minimum of €24bn for 2013 (EMCDDA 2016a) - an average of around €2bn 
per month - our data suggested global monthly revenues for cryptomarkets in the doublé digit million 
Euros (i.e. a minimum of $ 12.Om or €10.6m and a maximum of $21. lm or €18.7m). 

The availability of NPS via web shops on the clear net on the other hand, appeared to have increased 
quickly. There were, however, no reliable estimates of size and scope of NPS trade via the clear net and 
the size of the buyer population is unclear. 

Cryptomarkets are dominated by vendors who indicate they are operating from Anglo-Saxon countries 
(United States, Canada, Australia and the United Kingdom) and Western Europe (the Netherlands, 
Germany, Spain, France). Revenues to vendors operating from the Netherlands, however, are by far the 
largest on a per capita basis. This is perhaps not surprising given its important role in production and 
transit of drugs in Europe. The prominence of ‘Dutch vendors’ is particularly obvious for synthetic drugs, 
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which they sell in wholesale quantities more than vendors operating elsewhere. Furthermore, evidence 
suggests they export and domestic sales are a limited proportion of their business. The share of ‘Dutch 
vendors’ in the market for cannabis on cryptomarkets, however, is surprisingly small. 

While this study identified some information on the characteristics and motives of vendors and buyers 
involved in Internet-facilitated drugs trade, there is currently insufficiënt evidence to conclude whether 
the presence of online drug markets leads to new vendors or buyers that previously would not have sold or 
bought drugs offline, or whether the offline market is substituted by online markets. 

Merchandise 

1. Which types of drugs are being traded over the Internet? And how does the size of trade of different types of 
drugs relate to one another? (Section 4.3 and 4.4) 

Our results show that of all products and services on offer on the eight cryptomarkets examined in this 
study, 57 per cent of listings offered drugs. The results indicate that these drugs listings generated a total 
of monthly revenue of $l4.2m (€12.6 million) and $12.Om (€10.6m) when prescription drugs and 
alcohol and tobacco were excluded. These figures represent a lower-boundary estimate, as there are several 
caveats that cause our data from eight of the largest cryptomarkets cover about 80 per cent of all listings. 
Moreover, we assume at least 71 per cent of all transactions generated feedbacks, which we used to 
calculate revenues. An upper-boundary estimate for January 2016 drug revenues via visible listings on all 
cryptomarkets would be $25.Om (€22.lm) and $21.lm (€18.7m) when prescription drugs and alcohol 
and tobacco are excluded. 

Those drugs listings were dominated by cannabis (30 per cent), prescription drugs (24 per cent), ecstasy- 
type substances (17 per cent), stimulants (13 per cent) and psychedelics (11 per cent). Cannabis also 
generated the highest revenues, 31 per cent of all drugs revenues, followed by stimulants (24 per cent), 
ecstasy (16 per cent), psychedelics (8 per cent) and opioids (6 per cent). These revenue shares more or less 
mirror the retail value of different drug types in the offline world, particularly for stimulants and cannabis. 
Our results show that ecstasy-type drugs however, appeared to be much more popular on cryptomarkets 
than out on the Street, as they only constitutes about 2 per cent of the total European retail value 
according to the EMCDDA. On the other hand, EMCDDA estimates suggest that heroin takes up 
around 28 per cent of the total retail market for drugs in Europe, whereas our estimates suggest that 
opioids only have a market share of 6 per cent on cryptomarkets. 

A possible explanation for these differences between ‘online’ and ‘offline’ markets may be that 
cryptomarket purchases typically require an element of planning, which may not suit the daily use of 
dependent heroin users. Furthermore, some substances lend themselves better to ‘stealth shipping’ than 
others. 

In our analysis, those vendors who self-reported that they are shipping from the Netherlands are used as a 
proxy for ‘Dutch vendors’. This could be an underestimate, as there are indications that some vendors 
operating from the Netherlands drive to Germany and ship from there. Some 40 per cent of all ‘Dutch 
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This upper-boundary estimate does not include revenues via potential stealth listings, as there is no information 
about their extent to draw any meaningful assumptions. 
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listings’ were for ecstasy. Ecstasy-type drugs generate almost half of all revenues for ‘Dutch vendors’. 
‘Dutch vendors’ are responsible for a quarter of all revenues generated from ecstasy-type drugs on the 
eight cryptomarkets analysed. These fmdings can be understood in the context of the pivotal position of 
the Netherlands in European ecstasy production. 

Contrary to observations made by various interviewees, however, our results suggest that the share of 
‘Dutch vendors’ in cannabis sales is smaller than might be expected on the basis of the prominent role of 
the Netherlands in herbal cannabis production and transit of cannabis resin. Only 10 per cent of drugs 
revenues of ‘Dutch vendors’ is generated by cannabis. ‘Dutch vendors’ sell about 11 kg a month, just 2% 
per cent of the total global volume of cannabis traded on cryptomarkets. 

Previous research showed that clear net web shops primarily sell NPS. Elundreds different types of such 
designer drugs (often labelled as research Chemicals) are offered for sale, including synthetic cannabinoids, 
opioids, tryptamines, and benzodiazepines. 

2. In which volumes are the drugs offered? To what extent do these volumes refer towards Wholesale or retail? 
(Sections 4.5 and 4.6) 

Only 2 per cent of transactions analysed in this study exceeded $1,000, a majority of which we conclude 
were likely to be Wholesale purchases. This small share of Wholesale transactions, however, did generate 
about a quarter of the total drugs revenues on the markets analysed. The lion’s share of transactions on 
these cryptomarkets was generated by listings under $100, most likely to be for personal use. But these 
retail transactions generated only 18 per cent of total revenues. Most revenues were generated by listings 
priced between $100 and $500 (41 per cent). 

Bearing in mind the caveats of the analysis presented in this report, we found that a minimum of 475 kg 
cannabis was traded in a month on the analysed cryptomarkets, the bulk of which was offered in the price 
range of $100—$500 and higher than $1,000 (each 31 Per cent). Similar distributions were found for 
cocaine and MDMA powder, which were shipped in total volumes of 28 kg and 49 kg respectively. 

Similar to cryptomarkets, other studies have shown that clear net markets could also be used for wholesale 
purchases, both for business and social supply. The scale in which this is taken place, however, is 
unknown. 

3. To what extent are goods and services offered in support of other activities in the drugs supply 
chain? (Section 4.7.1) 

Products and services that might be used to support drug production, supply and use such as counterfeit 
IDs, financial products and services, or production equipment are listed on the cryptomarkets examined. 
They generate sales, albeit in negligible amounts in comparisons to drugs themselves. The total revenue 
generated by these products and services in January 2016 across the eight markets was about 0.2 per cent 
of the amount generated by drug sales. ‘Dutch vendors’ appear nearly absent in this business. 

4. To what extent are the drugs offered in combination with other (legal or illegal) goods or services? 
Ifso, which ones? (Section 4.7.2) 

Although it seems possible that drug vendors also sell goods and services that might be useful for drug 
dealers operating online or offline (e.g. money laundering), we found that cryptomarket vendors in our 
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sample specialised either in the sale of drugs or in the sale of other types of products. The majority of 
vendors (58 per cent) sold drugs and nothing else, and that share was even higher for ‘Dutch vendors’ (83 
per cent). It was relatively uncommon for vendors to sell drugs in combination with goods and services 
that are unrelated to drugs. ‘Dutch vendors’ on the analysed cryptomarkets almost exclusively specialise in 
drug sales, as only a small minority (7 per cent) did not sell drugs, compared to the overall share of non- 
drugs vendors (29 Per cent). 

Cryptomarkets and other Internet-based marketplaces 

5. How many cryptomarkets and other Internet-based marketplaces exist where drugs are tradedl 
How do these relate to each other in terms of listings? (Section 4.2) 

As part of this study, we identified about 50 live cryptomarkets and single-vendor shops on the dark web. 
As of mid-February, there were 19 active cryptomarkets with at least 400 listings each. The three largest 
markets, AlphaBay, Nucleus and Dreammarket, covered about 65 per cent of all listings. The eight 
markets scraped for this study had 105,811 listings, approximately 80 per cent of all listings across all 
cryptomarkets identified. 

Previous studies have highlighted the growing availability of NPS on the clear net. Various types of NPS 
are still legal and can be sold online, provided web shops indicate explicitly that they are not intended for 
human consumption. NPS web shops therefore typically label their merchandise as ‘research Chemicals’ 
The number of web shops reporting to be selling NPS in the EU has grown from 69 in 2008 to 314 in 
2011 and 651 in 2013. 

6. To what extent do cryptomarkets and other Internet-based marketplaces put restrictions on the 
drugs trade? (Section 3.1.4) 

The eight large cryptomarkets that were analysed have established rules, and most could be understood as 
seeking to reduce particularly third-party harm. Most marketplaces prohibited particular products and 
services from being listed by vendors for sale, such as child pornography, assassination services and banned 
weapons. Some had stated rules against blackmailing or ‘doxxing’ customers. And finally, some of these 
marketplaces explicitly encouraged participants in using security and encryption practices, with one 
stating that marketplace adjudication would be unavailable to participants not employing such practices. 
We have not come across any restrictions to sales to minors. 

7. Which trends can we observe in the field of cryptomarkets and other Internet-based marketplaces 
where drugs are being traded? (Section 3.2) 

We have observed a number of trends: 

• A series of security failures, scams and law enforcement disruptions and interventions have 
impacted on the longevity of individual cryptomarkets: they had a shorter lifespan between 
introduction and going offline. Despite the importance of trust between vendors, buyers and 
administrators for to the success of cryptomarkets and their vendors, commentators reported 
declining levels of trust between these actors. Nevertheless, the environment of reduced trust 
did not appear to have prevented the drugs trade on online marketplaces, and new 
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innovations and developments appear to have arisen allowing trade to flourish in spite of 
these challenges. 

• Exit scam risk and fear of law enforcement take down have led some vendors to establish 
single-vendor shops and to encourage potential buyers to approach them via (encrypted) 
email or direfct messaging. 

• Some technical innovations implemented on cryptomarkets, aimed at reducing the risks to 
vendors and buyers for scams, have been noted in the literature and interviews. Though not 
yet widely adopted, multi-signature escrow requires sign-off from two out of three parties, 
which makes it impossible for one party to single-handedly retrieve the funds and disappear. 

• Decentralised markets that operate using a peer-to-peer system, while still in their infancy, 
have the potential to reduce the possibilities of law enforcement disruption and intervention, 
as it will be impossible to take the entire system down. 

8. Wbat are the possible trends that occur in terms of the numher of vendors involved in drugs trade 

on the Internet and their listings? (Section 4.8) 

Our results suggest that the number of cryptomarket drug vendors has more than doubled from around 
thousand in 2013 to more than 2,700 in January 2016. This is probably an overestimate as there is some 
potential for double-counting when identifying unique vendor profiles across marketplaces. Nevertheless, 
the total number of cryptomarket vendors has clearly grown since 2013. 

We have also observed a six-fold increase in the total number of listings since then. Our results suggest 
that 57 per cent of all listings offered drugs on cryptomarkets. This indicates that non-drugs listings have 
become more common since the early days of Silk Road, when analysis into that market found that drugs 
represented the vast majority of listings. Overall revenues generated by drugs sales on cryptomarkets in 
2016, however, have only just doubled since 2013. 

Shipping routes 

9. From which countries do vendors operateprimarily? (Section 5.1) 

We undertook analysis to understand shipping routes via cryptomarkets and the role of the Netherlands 
in particular. Cryptomarket vendors appeared to be shipping from dozens of countries. To our 
knowledge, and that of the literature, cryptomarkets have primarily manifested themselves in the Anglo- 
Saxon world and Western Europe, but given their role in production, Asian countries (such as China and 
India) may also be fertile breeding ground for online drug sales. For this study we use vendors who self- 
report that they are shipping from the Netherlands as a proxy for ‘Dutch vendors’. 

Our data suggested that the Netherlands seems to play a prominent role in drugs trade facilitated by the 
cryptomarkets. We found 212 vendors that ‘ship from’ the Netherlands (13.4 vendors per million 
population). Most vendors appeared to be operating from the United States (890 or 2.8 per million 
population), followed by the United Kingdom (338 or 5.3 per million population), and Germany (225 or 
2.8 per million population). Revenues to vendors operating from the Netherlands in the cryptomarkets 
analysed was 2.4 times higher than those from the United Kingdom and 4.5 higher than those from the 
United States. 
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Based on literature and interview data, sales of NPS via clear net web shops seemed to be less prominent 
in the Netherlands than in other European countries. The I-TREND study found 19 shops operating 
from the Netherlands, compared to 207 from the UK and 72 from Poland. 

10. To which countries are vendors willing to ship? (Section 5.2) 

Scraped cryptomarket data did not offer insight into the geographic locations of buyers. However, looking 
at vendors’ ‘willingness to ship to’ information suggests that the most common shipping route on markets 
analysed is from and to North America (almost $5m in revenues), mostly American vendors selling to 
American customers. The second most important route in our data, generating $2m in revenues, was 
shipped from European vendors and to European buyers, followed by shipping to and from Oceania 
(Australia and New Zealand). There were only two ‘Dutch vendors’ who exclusively served the domestic 
market. 

11. Are there indications that the Netherlands is an important country oforigin for drugs trade on the 
Internet? (Section 5.1 and 4.3 — 4.7) 

‘Dutch vendors’ generated $l.lm and as such accounted for 7.8 per cent of total drug revenues from the 
eight markets monitored (9.1 per cent if prescription drugs and alcohol/tobacco were excluded). This 
makes the Netherlands the fifth largest Vendor country’, after the United States (35.9 per cent), United 
Kingdom (16.1 per cent), Australia (10.6 per cent) and Germany (8.4 per cent). Average revenues 
generated by Australian vendors was relatively high, probably because drugs tend to be more expensive 
there than in other countries. Compared to fmdings in 2013, the distribution of revenues across countries 
has not changed much with the exception of Australia, which has seen its share of revenues increase over 
the past three years. Australia also appeared to generate most revenues per vendor. This is in line with the 
vastly higher prices of drugs in Australia, which probably translates to higher prices per unit. 

Actors involved in Internet-facilitated drugs trade 

12. Which actors are involved in the trade of drugs on the Internet? (Chapter 6) 

There is consensus in previous literature and interviews that five key actors are (knowingly) involved in 
Internet-facilitated drugs trade: 

• Administrators have an executive management role on the marketplace and fulfil the role of 
treasurer. In terms of hierarchy, administrators sit at the top of cryptomarkets, and mostly 
have libertarian ideas for acting on these platforms. Administrators receive a commission for 
each sale fmalised through the marketplace; 

• Developers are commissioned to carry out web design (and maintenance). Some anecdotal 
evidence shows that they are young, IT-sawy males who conduct this work on a freelance 
basis; 

• Moderators are marketplace members of staff, potentially receiving a salary for their services, 
which include assisting with site maintenance and customer support; 

• Vendors sell drugs and other goods via their vendor page on a marketplace or their own 
single-vendor market and subsequently ship them via postal services; and 


104 


Internet-facilitated drugs trade 


RAND Europe 


• Buyers purchase drugs on vendors’ seller pages mosdy in exchange for cryptocurrency (e.g. 
Bitcoins), followed by feedback or radng. 

Other actors, who have a supporting role and may or may not be aware that they are involved in Internet- 
facilitated drugs trade include: cryptocurrency exchangers, Internet Service Providers, suppliers of legal 
goods and services (e.g. envelopes or precursors) and postal services. 

13. Wbat is known about the developers and administrators of such marketplaces and websites? 
(Chapter 6) 

Apart from the information summarised under research question 12, and despite some anecdotal 
information from media reports, the data available for this study did not provide additional evidence on 
the characteristics of developers and administrators. 

14. Wbat can be said about the characteristics of vendors? (Section 6.2) 

Based on limited, sometimes anecdotal, evidence from the literature, interviews and case file analysis it 
was found that vendors selling drugs on cryptomarkets seemed to be overwhelmingly young (under the 
age of 40), entrepreneurial, men from Anglo-Saxon countries or Western Europe with strong IT-skills. 
Arrest data partly confirm this, as 85 per cent of arrestees is male (when gender information is available) 
and their mean age is 33 years. Some vendors are buyers (consumers) of drugs as welk Although English is 
the dominant language on cryptomarkets, some vendors do communicate in their native language. 
Empirical research on vendors suggests that financial, libertarian and (perceptions of increased) safety 
motives underlie commencing selling drugs online. Vendors were a mix of professional dealers with close 
ties to production who consider Internet sales as an additional revenue stream and ‘newbies’ who thus far 
only sold drugs to friends. There were no studies identified in our literature review that provided 
information on the characteristics of vendors involved in clear net drugs trade. 

15. How does thepayment oflnternet-based drugs tradeproceed? (Section 3.1.2) 

Drugs purchased on cryptomarkets are typically paid for using cryptocurrency (e.g. bitcoins), but some 
markets even allow credit and debit cards, via a centralised escrow system: the transaction amount is held 
in deposit by the market place until the buyer confirms receipt by providing positive feedback. Vendors 
typically use crypto-exchangers to money launder their crypto-currencies. Successful vendors may be 
allowed to ‘fmalise early’ (FE) ensuring direct payment without funds first being held in escrow. Vendor 
and exit scams have given rise to alternative payment mechanism, such as those based on multi-signature 
escrow. 

Payment on online pharmacies or NPS web shops on the clear net may proceed via bitcoins, credit or 
debit cards, or online bank transfers. 

16. What is the modus operandi in the shipping of drugs? (Section 3.1.5) 

Vendors typically use legitimate postal services to ship drug orders to their customers. The ‘stealth factor’ 
determines the extent to which the true contents of the parcel have been concealed, for example, using the 
look-and-feel of other legitimate retail products. ‘Dutch vendors’ have been reported to travel to Belgium 
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or Germany to avoid stringent scanning practices in destination countries (particularly Australia and the 
United States) that are extra alert to parcels sent from the Netherlands. 

17. What can be said about (the development of) the size of the population ofcustomers/buyers in the 
Netherlands? (Section 5.2.2) 

Little evidence is available from previous studies about Dutch consumers who buy drugs via the Internet, 
and the cryptomarket data collected for this study do not offer any insights into Dutch buyers. Almost no 
listings were posted by ‘Dutch vendors’ that targeted only customers in the Netherlands. The limited 
number of studies identified in our review of the literature that reported on consumers buying drugs 
online found little to no evidence that Dutch customers were using the Internet to buy drugs. Demand 
side studies indicated that a small percentage of Dutch drug users purchase drugs online, although these 
studies (often self-reported surveys) did not distinguish between purchases on cryptomarkets and the clear 
net. As such, more research will be needed to more precisely estimate the population of customers in the 
Netherlands who purchase drugs online. A previous study looking at the number of online NPS shops 
based in the Netherlands, suggested that the market for purchasing NPS online is smaller in the 
Netherlands than in some other European countries. 

18. What can be said about the characteristics (age, criminal antecedents) of the customers/buyers? 
Which trends are occurring? (Section 6.3) 

Similar to vendors, according to previous research and interviewees, buyers tended to be relatively young, 
educated and digitally literate males from Anglo-Saxon and (other) European countries. The mean age of 
people arrested in relation to buying drugs on cryptomarkets was 25. Many seemed to be recreational 
users (some considered themselves ‘psychonauts’) who used drugs previously and were able to plan their 
consumption in advance. The motives for buying drugs online were similar to those found among 
vendors: (perceptions of) safety and quality when buying drugs online to the ease of speedy and stealth 
delivery. For some buyers, cryptomarkets replaced their local dealer, while others still relied on offline 
sources as welk 

19. What is the modus operandi in the buying and receiving of drugs? (Section 6.3.3) 

Section 6.2 provided insight in the various modus operandi of buyers reported in previous research and by 
experts interviewed for this study. Some highlights included: 

• Although cryptomarkets potentially facilitate the internationalisation of drugs retail markets, 
allowing buyers to purchase drugs from vendors around the world, some evidence suggests 
that, all other things being equal, buyers preferred to purchase drugs online from domestic 
sellers; 

• There have been examples on forums and seller Q&A pages where buyers could find 
information on techniques to avoid detection, such as the use of pseudonyms, having items 
delivered at addresses other than their home address and shipping of drugs in small 
quantities; 

• Trust in vendors seemed more important than loyalty to marketplaces; and 
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• A small share (between 2 and 6 per cent) of the transactions on the cryptomarkets analysed 
was made in wholesale quantities, suggesting that some buyers were dealers or social 
distributers. 

Avenues for intervention 

20. Wbicb broad strategies are available to law enforcement in the detection and intervention of the 
Internet-facilitated drugs trade? (Section 7.2) 

Based on interview and literature data, we identified four potential strategies that are available to law 
enforcement in the detection and intervention of Internet-facilitated drugs trade: 

1. Traditional investigation techniques applied in the drug chain (e.g. surveillance, undercover 
operations); 

5. Postal detection and interception (e.g. collaboration between law enforcement agencies and 
postal services); 

6. Online detection (e.g. big data techniques, monitoring of online marketplaces, tracking money 
flows); and 

7. Online disruption (e.g. taking down online marketplaces). 

21. Wbicb barriers do law enforcers face in the Netberlands in detection and prosecution of drugs 
trade on the Internet? (Section 7.2) 

For each of these four strategies of detection and intervention barriers were identified by interviews and in 
the literature. Section 7.2 provides a detailed overview of barriers for each strategy, but some cross-cutting 
challenges were: 

• Resources and capacity; 

• Attracting, developing and maintaining skills; 

• Dealing with multiple jurisdictions and managing internationally competing interests; 

• Privacy protection and other legal restrictions to monitoring online behaviour, screening 
parcels, or traditional surveillance; 

• Challenges related to encryption, attribution and fluctuation; and 

• The resilience of online communities and illicit activities. 

22. What were the consequences of bringing down marketplaces? To wbat extent did any substitution 
ejfects occurl (Section 7.2.4) 

Anecdotal evidence from the literature suggests that law enforcement activities have had an impact on 
confidence in cryptomarkets, but it has been suggested that the negative impact on trust of scams within 
markets might be greater than what law enforcement action could achieve. Previous studies have found 
that the main consequence of bringing down marketplaces has been the migration of vendors and 
customers to other existing cryptomarkets or to new marketplaces, and the implementation of innovative 
Solutions by some cryptomarkets to prevent losses or maintain anonymity. 
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Appendix A: Drug categories 


Table A. 1. Drug categories 


Drug category Drug types included in the category 


Cannabis 

edibles 

extracts 

hash 

herbal 

synthetics 

other 

Ecstasy-type 

MDMA: pills, crystal, powder 

euphoric stimulants 

cathinones 

combinations of above 

Prescription 

benzodiazepines, sedatives, hypnotics, 

opioids 

steroids, androqens, anabolic aqents, 

stimulants 

anti-cancer 

anti-depressants 

sexual dysfunction 

infertility, contraception, abortion 

other prescription druqs 


Psychedelics NBOMes 


Stimulants 

2-cs 

other phenethylamines 

tryptamines 

lyserqides 

dissociatives 

other 

amphetamines 

cocaine 

methamphetamine 

other synthetics 

piperazines 1table continues on next paqe] 
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Table A. 1. Drug categories (continued) 


Drug category 

Drug types included in the category 

Opioids 

heroin 


NPS opioids 


other 

Alcohol 


Tobacco + nicotine 


Other drugs 
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Table B.l. Search strategy 6465 






Search 

queries 







"online drug 

"online drug 

("online drug market*" 

drug* AND 

("drug* 

("illict drug*" OR 

"cybercrime" 

("legal high" OR 

"law 

"law 


market*" OR "online 

market*" OR "online 

OR "online bazaar" OR 

("dark net" 

sale*") AND 

"legal high" OR 

AND ("illicit* 

"new psychoactive 

enforcement" 

enforcement" 


bazaar" OR "dark 

bazaar" OR "dark 

"dark net" OR darknet 

OR darknet 

("clear net" 

"new psychoactive 

drug*' 1 OR 

substance*" OR 

AND "illicit 

AND NPS 


net" OR darknet OR 

net" OR darknet OR 

OR "dark web" OR 

OR "dark 

OR internet 

substance*" OR 

"legal high" OR 

"NPS" OR 

drugs" AND 

AND ("clear 


"dark web" OR 

"dark web" OR 

cryptomarket* OR 

web" OR 

OR "open 

"NPS" OR 

"new 

"research 

("dark web" 

net" OR 


cryptomarket* OR 

crypto market* OR 

"crypto market" OR 

"cryptomark 

web") 

"research 

psychoactive 

chemical*") AND 

OR "dark net" 

internet OR 


"crypto market" OR 

"crypto market" OR 

"Tor Network", "drug* 

et*' 1 OR 


chemical*") AND 

substance*" OR 

(online OR "online 

OR darknet) 

"open web") 


"Tor Network" OR 

"Tor NetWork" OR 

traffic*" OR "drug 

"crypto 


("clear net" OR 

"NPS" OR 

sale" OR "social 




"online drug* 

"online drug* 

trade") AND ("Silk 

market*" 


internet OR "open 

"research 

media" OR 




traffic*" OR "online 

traffic*" OR "online 

Road" OR "Pandora" 

OR "deep 


web") 

chemical*") 

advertis* OR 



Databases J, 

drug trade" 

drug trade" 

OR "Agora") 

web") 




headshop*) 




Google Scholar 

Total number of hits: 

5,370 

Total relevant hits: 0 

Total number of hits: 

24,300 

Total relevant hits: 2 

Total number of hits: 44 

Total relevant hits: 1 1 

Total 

number of 
hits: 1,380 
Total 

relevant hits: 

4 

Total number 

of hits: 239 

Total relevant 

hits: 0 

Total number of 
hits: 79,800 

Total relevant hits: 

3 

Total number of 

hits: 281 

Total relevant 

hits: 0 

Total number of 
hits: 255,000 

Total relevant hits: 

0 

Total number 

of hits: 88 

Total relevant 

hits: 4 

Total number 

of hits: 

4,530 

Total 

relevant hits: 

2 

Google 0 

Total number of hits: 
2,560,000 

Total relevant hits: 1 

Total number of hits: 
4,120,000 

Total relevant hits: 0 

Total number of hits: 
63,400 

Total relevant hits: 0 

Total 

number of 

hits: 

338,000 

Total 

relevant hits: 

Total number 

of hits: 

68,200,000 
Total relevant 

hits: 0 

Total number of 
hits: 2,370,000 
Total relevant hits: 

0 

Total number of 
hits: 79,400 

Total relevant 

hits: 1 

Total number of 
hits: 17,600,000 
Total relevant hits: 

3 

Total number 
of hits: 8,010 
Total relevant 

hits: 1 

Total number 

of hits: 

310,000 

Total 

relevant hits: 

0 


o 


64 The searches where conducted on 3 and 4 January 2016. 

65 For Google and Google Scholar, only the first two results’ pages were scanned for relevant literature. For the other databases, the first 100 results were scanned. 
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Search queries (continued from previous page - similor search queriesj 



"online drug 

"online drug 

("online drug market*" 

drug* AND 

("drug* 

("illict drug*" OR 

"cybercrime" 

("legal high" OR 

"law 

"law 


market*" OR "online 

market*" OR "online 

OR "online bazaar" OR 

("dark net" 

sale*") AND 

"legal high" OR 

AND ("illicit* 

"new psychoactive 

enforcement" 

enforcement" 


bazaar" OR "dark 

bazaar" OR "dark 

"dark net" OR darknet 

OR darknet 

("clear net" 

"new psychoactive 

drug*' 1 OR 

substance*" OR 

AND "illicit 

AND NPS 


net" OR darknet OR 

net" OR darknet OR 

OR "dark web" OR 

OR "dark 

OR internet 

substance*" OR 

"legal high" OR 

"NPS" OR 

drugs" AND 

AND ("clear 


"dark web" OR 

"dark web" OR 

cryptomarket* OR 

web" OR 

OR "open 

"NPS" OR 

"new 

"research 

("dark web" 

net" OR 


cryptomarket* OR 

crypto market* OR 

"crypto market" OR 

"cryptomark 

web") 

" research 

psychoactive 

chemical*") AND 

OR "dark net" 

internet OR 


"crypto market" OR 

"crypto market" OR 

"Tor NetWork", "drug* 

et*' 1 OR 


chemical*") AND 

substance*" OR 

(online OR "online 

OR darknet) 

"open web") 


"Tor NetWork" OR 

"Tor NetWork" OR 

traffic*" OR "drug 

"crypto 


("clear net" OR 

"NPS" OR 

sale" OR "social 




"online drug* 

"online drug* 

trade") AND ("Silk 

market*" 


internet OR "open 

"research 

media" OR 




traffic*" OR "online 

traffic*" OR "online 

Road" OR "Pandora" 

OR "deep 


web") 

chemical*") 

advertis* OR 



Databases j 

drug trade" 

drug trade" 

OR "Agora") 

web") 




headshop*) 



EBSCO (Criminal 

Total number of hits: 

Total number of hits: 

Total number of hits: 

Total 

Total number 

Total number of 

Total number of 

Total number of 

Total number 

Total number 

Justice Abstracts; 

79 

79 

(AND Silk Road:5,762); 

number of 

of hits: 

hits: (AND "clear 

hits: 15,535 

hits: (AND 

of hits: 0 

of hits: 4 

Social Sciences 

Total relevant hits: 2 

Total relevant hits: 0 

(AND Pandora: 6,015); 

hits: 28 

152,092 

net": 16,019); 

Total relevant 

"online": 15,532); 

Total relevant 

Total 

Abstracts; 



(AND Agora: 5,845) 

Total 

Total relevant 

(AND internet: 

hits: 0 

(AND "online 

hits: 0 

relevant hits: 

Academie Search 



Total relevant hits: 0 

relevant hits: 

hits: 0 

16,031); (AND 


sale": 15,524); 


i 

Complete; EconLit; 




0 


"open web": 


(AND "social 



and National 






16,019) 


media": 15,524); 



Criminal Justice 






Total relevant hits: 


(AND adverstis*: 



Reference Service 






0 


15,524 ); (AND 



Abstract$) b 








headshop: 15,525) 




Total relevant hits: 
0 


The Campbell 

Total number of hits: 

Total number of hits: 

Total number of hits: 0 

Total 

Total number 

Total number of 

Total number of 

Total number of 

Total number 

Total number 

Collaboration 

0 

92 

Total relevant hits: 0 

number of 

of hits: 0 

hits: 98 

hits: 0 

hits: 257 

of hits: 0 

of hits: 0 

Library of 

Total relevant hits: 0 

Total relevant hits: 0 


hits: 0 

Total relevant 

Total relevant hits: 

Total relevant 

Total relevant hits: 

Total relevant 

Total 

Systematic 




Total 

hits: 0 

0 

hits: 0 

0 

hits: 0 

relevant hits: 

Reviews 0 




relevant hits: 

o 






0 

Taylor and Francis 

Total number of hits: 

Total number of hits: 

Total number of hits: 0 

Total 

Total number 

Total number of 

Total number of 

Total number of 

Total number 

Total number 

Online d 

90 

913 

Total relevant hits: 0 

number of 

of hits: 1 1 

hits: 0 

hits: 0 

hits: 0 

of hits: 0 

of hits: 0 


Total relevant hits: 3 

Total relevant hits: 0 


hits: 65 

Total relevant 

Total relevant hits: 

Total relevant 

Total relevant hits: 

Total relevant 

Total 





Total 

hits: 0 

0 

hits: 0 

0 

hits: 0 

relevant hits: 





relevant hits: 

0 






0 

PubMed 6 

Total number of hits: 

Total number of hits: 

Total number of hits: 0 

Total 

Total number 

Total number of 

Total number of 

Total number of 

Total number 

Total number 


1285 

125 

Total relevant hits: 0 

number of 

of hits: 0 

hits: 132 

hits: 0 

hits: 167 

of hits: 0 

of hits: 2 


Total relevant hits: 0 

Total relevant hits: 0 


hits: 1 85 

Total relevant 

Total relevant hits: 

Total relevant 

Total relevant hits: 

Total relevant 

Total 
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Total hits: 0 0 hits: 0 1 hits: 0 

relevant hits: 

0 

Dark net: 29 (1 
relevant) 

Drugs internet: 138 
(0 relevant) 

Silk Road: 1 8 hits (0 
relevant) 

New Psychoactive 
Substances: 1 10 hits 
(1 relevant) 

NOTES: 

a Excluding news articles and specific websites about the dark net. 
b Searched for all except 'news', 'magazines', 'reviews' 
c Searched in 'all text' 

d Used advanced search: 'search everything', journal, 'all content'. 
e Use of general 'search' box. 

f Current search strings did not lead to any results, so used different, shorter search terms instead. 


International 
Society for the 
Study of Drug 
Policy Grey 
Li te ra tu re 
Bibliography f 


relevant hits: 
0 
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Table B.2. Additional websites searched 


Additional websites searched: 

Comments 

Enisa country reports and national security strategies 

No publications 

Publications on www.ncsc.nl 

No publications 

EMCDDA's annual European Drug Reports 

Publications found 

Reports INCB 

Publications found 

Reports UNODC 

Publications found 

Kamerstukken: https://zoek.officielebekendmakingen.nl/zoeken/parlementaire_documenten 

Publications found 

Websites of law enforcement agencies (e.g. Europol, Interpol, Eurojust, FBI, US Immigration and Customs 
Enforcement, National Crime Agency (UK), etc.) 

Publications found 
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Appendix C: OverView of studies that collected quantitative information on online drug markets 


Table C.1. OverView of studies that collected quantitative information on drug markets on the dark net 


Study details 

Data collection method(s) 

Number 

markets 

of Listings 

Number of Country of origin of 

vendors vendors 

Size 

1. Aldridge and 
Décary-Hétu 
(2016a). 
Academie 
paper 

Primary research (crawling Silk 
Road 1.0 between 13-15 
September) Revised approach on 
Aldridge and Décary-Hétu 2014 
data, as included below 

One market 
analysed 

10,927 active drug listings 

1,031 vendors 

41 countries. For 1 1 
countries vendors were 
involved in Wholesale 
level transactions 
(countries with the 
highest share of listings 
>$ 1,000 were: China 
(46%), Belgium (20%), 
Canada (15%) and the 
Netherlands (1 2%)) 

Estimated monthly 
revenue for selected 
drug categories: 
cannabis ($2,038,213); 
ecstasy $1,61 3,840); 
opioids ($284,972); 
prescription ($999,872); 
psychedelics 
($712,574); stimulants 
($1,330,989) 

2. Soska and 
Christin 
(2015). 
Academie 
paper 

Primary research (long-term 
measurement analysis through 
crawling and parsing° 16 market 
places between 2013-2015), 
combined with secondary data 

Initial scraping A total of 78,509 items that 

of 35 markets, "returned at least one 

of which 1 6 acceptable observation" were 

were then identified (p. 8) c 

parsed and 

further 

analysed b 

9,386 vendors 
across the 

measurement 
interval (29,258 

unique aliases) 

Not examined/ not 
mentioned in study 

Seven markets were 
used to measure the 
revenues yet not all were 
active at the same time. 
Revenues appear to be 
in the $550,000/day to 
$650,000/day range 
(Silk Road in summer of 
2013: ~300,000/day, 


129 





RAND Europe 


Internet-facilitated drugs trade 


Study details 

Data collection method(s) 

Number of Listings 

markets 

Number of Country of origin of 

vendors vendors 

Size 







which would be about 
$ 1 00m annually) 

3. Dolliver 
(2015) d . 
Academie 
paper 

Primary research (crawling Silk 
Road 2.0 in August and 

September 201 4) 

One market 
analysed 

1,834 unique items, 348 
drug items (mostly stimulants 
and hallucinogens) 

145 vendors 

Vendors shipped from 

1 9 countries. For drug 
items, this mainly 
involved: US (26%), 
Germany (14%), UK 
(1 3.8%) and Australia 
(1 3%). The Netherlands 
represented 6%. 

Not examined. 

4. Buxton and 
Bingham 
(2015) 

Not reported for these data (May- 
October 201 4) 

Th ree markets 
included 
(Evolution, 
Agora and Silk 
Road 2.0) 

Evolution: 1 7,51 2 listings; 
Agora: 17,200 listings; and 
Silk Road 2.0: 15,837 
listings (listings not further 
specified). Listings of these 
markets reflected 81% of total 
listings on cryptomarkets 
between May-October 2014 

Not examined/ 
not mentioned in 
study 

Not examined/ not 
mentioned in study 

Market share of total 
listings: Evolution: 28%; 
Agora: 27.5%; Silk 

Road 2.0: 25.3%. This 
reflected a 41% market 
contribution to 
cryptomarkets between 
May-October 2014 

5. Bartlett (2015). 
Journalism 

Secondary research (analysis of 
sales data of top vendors on Silk 
Road 2 between January and April 
2014. Data used for this analysis 
were collected by an anonymous 
SR user who posted the data files 
on a forum) 

One market 
analysed 

Not examined/ not 
mentioned in this study 

Study looked at 
a sample of 867 
vendors 

United States (33%), 
United Kingdom (10%) 
and Australia (1 0%). 
Remaining percentages 
not reported in this study 

Annual income between 
$60,0004120,000 per 
vendor (rough estimate 
based on a selection of 
nine medium-size 
vendors) 

6. Ciancaglini et 
al. (2015). 
Report 

Secondary research, but lacks 
transparency and clarity about 
methodology (made use of 
https://dnstats.net/ that collects 
dark net markets' data. Data 
retrieved 3 June 201 5) 

All dark net 
markets (not 
further 
specified) 

Cannabis (31.60%); 
pharmaceuticals (21.05%); 

MDMA (10.53%); LSD, meth, 
mushrooms, heroin, seeds, 
video games, Online accounts 
(all 5.26% each) e 

Not examined/ 
not mentioned in 
study 

Not examined/ not 
mentioned in study 

Not examined/ not 
mentioned in study 
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Study details 


Data collection method(s) 


Number 

markets 


of Listings 


Number of Country of origin of Size 
vendors vendors 


Aldridge and Primary research (crawling Silk 
Décary-Hétu Road 1.0 in September 2013) 
(2014). 

Academie 

paper 


7. 


One market 1 1,904 active listings in Silk 
analysed Road's 'drugs' section 

(1 1,853 relevant listings were 
included for analysis), with six 
categories capturing 90% of 
all drug listings (cannabis, 
ecstasy, opioids, 
prescriptions, psychedelics 
and stimulants) 


1,084 

vendors in Silk 
Road's 'drugs' 
section 


Not examined/ not 
mentioned in study 


Annual revenue for 90% 
of 'drug' listings 
estimated at $89.7m 


8 . 


9. 


Kooistra and 

Primary research (crawling 4 

4 markets 

Not examined/not mentioned 

Study only 

NA (only looked at 

The Dutch share was 

Trommelen 

market places for 1.5 months in 

analysed 

in study (study refers to type 

looked at the 

share of Dutch vendors) 

estimated to be 12% (of 

(2014). 

2014, only looking for Dutch 

(Agora, 

of drugs that was sold online, 

share of Dutch 


€81 m total revenue) on 

Journalism 

share on these sites) 

Pandora, Silk 

see 'Size') 

vendors (or 


Agora and 7% (of €64m 



Road 2, 


Dutch web 


total revenue) on Silk 



Evolution) 


shops/dealers as 


Road 2 annuallyd The 





they call it) and 


share is unknown for 





found 26 Dutch 


Pandora and Evolution. 





web shops on 


Type of drugs sold 





these market 


online by Dutch vendors: 





places 


ecstasy (29%), herbal 
cannabis (27.5%), 
cannabis resin (16.4%), 
cocaine and speed 
(1 5.6%), heroin and 
opiates (5.7%), 
psychedelics (LSD) 
(3.8%), other (2.0%) 

Digital Citizens Primary research (monitoring the 

1 2 markets 

As of 29January 201 4: a 

Not 

Not examined/not 

Not examined/not 

Alliance 

listings on 1 2 market places, 

analysed 

total of 32,029 drug listings 

examined/not 

mentioned in study 

mentioned in study 

(2014a). 

method not further specified. 


across 1 2 market places (out 

mentioned in 



Report 

Conducted one day in January 


of a total of 41,207 listings). 

study 




2014) 


Type of drugs not further 





specified. 
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Study details 

Data collection method(s) 

Number 

markets 

of Listings 

Number of Country of origin of 

vendors vendors 

Size 

10. Digital Citizens Primary research (monitoring the 

1 2 markets 

As of 17 December 2014: a 

Not 

Not examined/not 

Not examined/not 

Alliance 

(2014b). 

Report 

listings on 1 2 market places, 
method not further specified. 
Conducted one day in December 
2014) 

analysed 

total of 32,362 drug listings 
across 1 2 market places (out 
of a total of 51 ,755 listings). 
Type of drugs not further 
specified 9 

examined/not 
mentioned in 
study 

mentioned in study 

mentioned in study 

1 1. Phelps and 

Primary research (lack of clarity on 

One market 

Listings from vendors based in 

27 vendors who 

27 vendors who 

Not possible to provide 

Watt (2014). 

Academie 

paper 

methodology used for quantitative 
data, which involved monitoring 
Silk Road through using a user 
account. Conducted in July 201 2) 

analysed 

Australia: 191 listings, which 
were all listed in the 

Australian Drug Misuse and 
Trafficking Act (not further 
specified) 

indicated to be 
based in 

Australia 

indicated to be based in 
Australia 

accurate calculation 

12. Van Buskirket 

Primary research (monitoring 

23 markets 

Study looked at the number of 

International and 

Not examined/not 

Not examined 

al. (2014). 

markets through using a domestic 

analysed of 

retailers selling substances to 

domestic 

mentioned in study (only 


Report 

user account. Conducted between 
July 2014 and December 2014). 
Only focused on international 
retailers selling to Australia and 
Australian retailers. 

which 1 1 Australia (only for five 

remained active markets: Agora, Evolution, 
during the Silk Road 2.0, Pandora and 

monitored Cloud Nine): cannabis, 

period h ' pharmaceuticals and MDMA 

were most commonly 
available 

vendors selling 
to Australia 
varied per 
market. Retailers 
on markets still 
active in 

December 2014: 
Evolution 
(1 1 54); Agora 
(836) and 
Nucleus (almost 
200) 

looked at 'international' 
versus 'domestic') 


1 3. Christin 

Primary research (crawling Silk 

One market 

In total, over 24,400 unique 

220 in 

Top 5 "most frequent 

Total revenue slightly 

(2013). 

Road 1.0 for 8 months between 

analysed 

items were identified (not just 

November 

shipping origins" (p. 5, 

over $1,2m per month 

Academie 

paper 

201 1-2012) 


drugs), with main categories 
relating to narcotics or 
controlled substances, with 
marijuana accounting for the 

2011; 564 in 

July 2012 (a 
core of 1 1 2 
vendors 

more details included in 
Table 2 of the study): 

USA (43.83%); 
undeclared (16.29%); 

(annual revenue of 
~$ 15m) 
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Study details 

Data collection method(s) 

Number 

of Listings 

Number of Country of origin of Size 



markets 


vendors 

vendors 




top category 

throughout 

UK (10.15%), the 





studied period) 

Netherlands (6.52%) 
and Canada (5.89%) 

1 4. Van Buskirk et 

Primary research (monitoring Silk 

One 

Study looked at the number of 

International and 

Not examined/not Not examined 

al. (2013). 

Road every fortnight between 

cryptomarket 

retailers selling substances to 

domestic 

mentioned in study (only 

Report 

August 201 2 and February 201 3, 

analysed h 

Australia: cannabis, NPS 

vendors selling 

looked at 'international' 


with one search in December 


(study speaks of 'Emerging 

to Australia rosé 

versus 'domestic') 


201 2. Only focused on 


Psychoactive Substances') 

from 282 mid- 



international retailers selling to 


and MDMA were most 

September 201 2 



Australia and Australian retailers) 


commonly available 

to 374 in early 
February 2013. 
Domestic 
vendors 
specifically 
increased from 

36 mid- 

September to 44 
in February 

2013 
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Table C.2. OverView of studies that collected information on clear net markets 


66 


Study details 


Data collection Number of markets Listings 

method(s) 


Other information 


1. Martinez et al. (201 6). 
Report 


2. EMCDDA (2009). 
Report 


3. EMCDDA (2011a). 
Report 


Primary research (use of 
own software called 
'Shop Finder' and 
'Product Scraper' tailored 
for "country-specific 
search phrases and 
search engines" (p. 98). 
Monitoring of online 
shops was conducted 
between November 
201 3 and May 2014) 

Primary research 
(EMCDDA snapshot 
methodology, see 
EMCDDA 2011b. 
Conducted in 2009) 


As of May 2014, 584 
shops were identified. 

The following number of 
shops active as of May 
2014 werefduplicates 
removed): Czech 
Republic (30), France 
(64), the Netherlands 
(1 9), Poland (72) and the 
United Kingdom (207) 


1 15 shops were 
identified, located in 17 
countries 


Listings for each shop not 
provided, but study looked at 
NPS 


Majority of shops were classified as shops selling research 
Chemicals. Classifications are: "research chemical shops' if 
the substances are displayed mostly with their chemical 
names, often with an image of their chemical structure; 
'commercial/branded shops' if the substances are mainly 
displayed with their trade names; 'herbal shops' if the site 
offers primarily plant-related substances as well as 
commercial products; 'other' if the sites offer products 
relating to sexual performance, health or general wellness" 

(p. 100). 


Listings not provided in detail, "The majority of online retailers identified were based in 
but report does specify for the United Kingdom (37 %), Germany (15 %), 

particular psychoactive Netherlands (14 %) and Romania (7 %)" (p. 93). 

substances where they were 
found 


Primary research 
(EMCDDA snapshot 
methodology, see 
EMCDDA 2011b. 
Conducted between 
December 2009 and 


3 14 online shops 
identified that sold 'legal 
highs' in 201 1; 23 shops 
selling mephedrone early 
011 ) 


Listings not provided in detail, 
but report does specify for 
particular psychoactive 
substances where they were 
found 


There is a detailed overview of "apparent country of origin 
of online shops offering 'legal highs'" (p. 96) and an 
overview of where online shops selling mephedrone are 
based. 


66 The included articles did not use the term ‘clear net’, yet talk about ‘Internet’ more generally. However, given their methods used, the research team assumed this was clear net. 
Where studies only briefly referenced to, for example, a number of online shops and sometimes without indicating through which methods this number was obtained, this was not 
included in this table. An example is a report by DrugScope (2014), which mentioned that there are around 250 online and offline shops in total in the UK that sell NPS. Another 
example includes work by Schifano et al. (2005), in which it was only briefly mentioned that of the websites identified, 5 websites offered the option to buy a particular NPS (2C- 


T-7). 
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Study details 


4. EMCDDA (201 lb). 
Report 


5. Hillebrand, J., Olszewski, D. 
and Sedefov, R. (2010). 
Academie paper 


6. Nizar, H., Dargan, P.l. and 
Wood, D.M. (2015). 
Academie paper 


7. Van Buskirketal. (2014). 
Report 


Data collection Number of markets Listings 

method(s) 


February 2011)° 


Primary research (annual 
EMCDDA snapshot study 
through crawling "online 
websites (retailers and 
Wholesale) easily 
accessible to a random 
Internet user interested in 
buying psychoactive 
substances" (p. 3). 
Conducted in July 2011) 


63 1 online shops 
identified that sold NPS 
in July 201 l b 


Table 2on p.6 of the report 
provides an overview of the 
"most frequently identified" 
NPS (p. 6). 


Primary research 
(EMCDDA snapshot 
methodology, see 
EMCDDA 2011b. 
Conducted between 
February 2008 and June 
2008) 


69 online shops in the EU Report focused on 'legal 
were identified highs' and 'herbal highs'. For 

a selection of 27 shops, more 
than 500 unique products 
were advertised 


Primary research 20 websites selling 4- 

(EMCDDA snapshot methylaminorex and 1 

methodology, single-time selling 4,4’- 
point English only through dimethylaminorex 
using google.co.uk. identified 

Conducted in April 
2014) 


This study specifically looked 
at two NPS: 4- 
Methylaminorex and 4,4'- 
Dimethylaminorex 


Primary research 
(EMCDDA snapshot 
methodology by using 
Zoo search engine. 
Online forums were 
searched references to 


Study speaks of "number This study focused on NPS by 
of unique retailers" (p. 3): searching for 'legal highs', 

67 in July 2014; 78 in 'research Chemicals' and 
December 2014 other equivalents, but listings 

identified on these web shops 
were not provided 


Other information 


The "likely" countries of origin of the shops were listed (p. 
4). Prices for most frequently identified NPS were 
provided. 


Country of origin of shops was reported (n = 69): Austria 
(4.4%); Ireland (1.5%); Germany (5.8%); the Netherlands 
(36.2%) and the United Kingdom (52.2%). Prices for 
selected NPS were provided. 


Prices were provided. 


The increase in number of retailers might be explained by 
expanded methodology instead of an actual rise. 
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Study details Data collection Number of markets Listings 

method(s) 

NPS web shops on the 
clear net. Conducted 
between July 2014- 
December 2014). Only 
focused on those websites 
selling and shipping to 
Australia. d 


8. Van Buskirk et al. (201 3). Primary research 
Report (EMCDDA snapshot 

methodology using a 
Metacrawler search 
engine. Conducted 
monthly between August 
2012-February 201 3, 
except December 2012). 
Only focused on websites 
shipping to Australia. d 


Study speaks of 'number "Number of retailers selling 
of unique retailers" (p. 3): the ten mostcommon EPS" 
92 in September 201 2; (i.e. NPS, study speaks of 

101 in February 201 3 'Emerging Psychoactive 

Substances') in September 
2012-February 201 3 (p. 5): 
6-APB (149), Ethylphenidate 
(126); aMT (123); 
Methiopropamine (1 15); 
MDAI (104); 5-MeO-DALT 
(101); Etizolam (99); 
AM2201 (96); UR-144 (85); 
5-APB (82). e 


9. Schifano, et al. (2006). 
Academie paper 


Primary research N/A f 

(snapshot study of a 
"purposeful sample of 
1 633 unique 
websites"(p. 640). c 
Conducted during one 
week in June 2003) 


Examples included, but not 
limited to, opioid analgesics 
and Plants, herbs, mixtures 


10. Schmidt, M.M., Sharma, A., 
Schifano, F. and Feinmann, 
C. (201 1). 

Academie paper 


Primary research 
(snapshot study of a 
"purposeful sample of 
264 results" (p. 93) as 
found through using two 


39 online shops in the UK 346 unique products were 
were identified identified across all shops 

(see table 1 on p. 95 for the 
top 25 products) 


Other information 


A total of 1 65 websites (10.1%) offered "the possibility to 
purchase drug-related items (including paraphernalia 
and/or psychoactive drugs)" (p. 643). 


Average price of per product was £9.69. 
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Study details 

Data collection Number of markets 

method(s) 

Listings 

Other information 


search engines to search 
for UK-based Online 
shops selling legal highs. 
Search conducted on 7 
April 2009 and selected 
websites analysed 
between April-June 2009) 




1 1. Bigdeli, 1., Corazza, O., 
Aslanpour, Z., Schifano, F. 
(2013). 

Academie paper 

Primary research 
("qualitative exploratory 
online search and 
monitoring" of Persian 
language websites (p. 
512). Conducted 

October 201 1-February 
2012) 

51 websites aimed at 
"NPS purchase" (p. 512) 

Herbal, chemical-synthetic 
and semi-synthetic drugs, 
pharmaceuticals, 
others/combinations 
(categories further specified 
in report) 

This study was more focused on the type of NPS sold 
online instead of estimating the size. 

12. Corazza, O., Sulaf, A., 
Malekianragheb, S. ( Mitra 
Naderi, B., Bigdeli, 1., 
Aslanpour, Z., Schifano, F. 
(2014). 

Academie paper 

Primary research 
(monitoring websites in 
Farsi and Arabic through 
different search engines. 
Conducted between 
October 201 1 and 
September 201 3) 

65 websites identified 
"were deemed to be pro 
drug websites and 
appeared to be offering 
NPS for purchase'' (p. 
725) 

45 NPS identified (typically 
included: cathinone 
derivatives, classical/latest 
generation 

psychedelicphenethylamines, 
ketamine derivatives, 
tryptamines and 'Spice' 
derivatives) 

Prices varied between $8 and $230). This study was more 
focused on the type of NPS sold online instead of 
estimating the size. 

13. Deluca, P., Davey, Z., 
Corazza, O., Di Furia, L, 
Farre, M., Flesland, L., 
Mannonen, M., Majava, A., 
Peltoniemi, T., & Pasinetti, 

M. (2012). 

Academie paper 

Primary research 
("qualitative exploratory 
online searches" by using 
several resources in 8 
languages (p. 222). 
Conducted between 

2008 and 2010) 

203 websites were 
identified, which 
consisted of a mix of 
forums, shops, social 
media, etc. 

414 substances and products 
were found on these websites 
(not specified which ones 
were found on online shops) 

This study does not distinguish between website or forum, 
so it is unclear how many of them were online shops. 

14. Lahaie, E., Martinez, M. and Primary research 

30 online shops in French NPS (no further details 
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Study details 

Data collection Number of markets 

method(s) 

Listings 

Other information 

Cadet-Taïrou, A. (2013). 

(snapshot, methodology language 

provided) 


Report 

not further specified. 

Conducted at the end of 




201 1) 




NOTE: 


" Note that several snapshots were conducted in this period. The study separately reports on searches conducted for 'legal highs' in 2010 and 201 land searches conducted for 
mephedrone between December 2009 and February 2011. 

b In January 2012, this number was 693 in January 201 2 (EMCDDA and Europol, 201 3) and 651 in 201 3 (EMCDDA 201 5a) 

c "An 8-language, two-engine, assessment of the information available in a purposeful sample of 1633 unique websites was carried out" (Schifano et al. 2006, 640). Search 
engines included Google and AltaVista. Languages covered: English, French, Italian, Finnish, Danish, German, Spanish and Portuguese. 

d This study also looked at the dark web, as discussed in Table C. 1. 
e According to the authors, these numbers do not reflect unique retailers. 

f The study aimed to collect data on drug-related content on websites, including information on consumption and production, not just sales. 
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Appendix E: List of interviewees 


This appendix lists the individuals interviewed or otherwise consulted as part of this study. Those who 
consented have been named in alphabetical order; others have been anonymised by function and/or 
affiliation. In case interviewees preferred not to be listed at all, they have been omitted from this list. 


Table E.l. List of interviewees 


Name 

Anonymous 

Anonymous 

Anonymous 

Anonymous 

Anonymous 

Ben van Scheppingen 

Bert-Jan Kamstra 

Daan van der Gouwe 

Detective Inspector Stefan Kalman 

Inge Philips 

Dr James Martin 

Jane Mounteney 

Jirko Patist, Officier van Justitie 

Koen Hermans 

Dr Laura Orsolini, MD, Psychiatrist, MSc 
Crim, member of the EU-MADNESS team 
and senior research assistant for the 
EPS/NPS project 

Magali Martinez, Head of project 


Institution 


Country 


NA NA 

NA NA 


UK's National Crime Agency (email 
correspondence) 

Dienst Landelijke Recherche, Dutch Police 
Dienst Landelijke Recherche, Dutch Police 
Dutch Police 
FIOD 

Trimbos Institute 
Swedish Police Authority 
Police 

Macquarie University 
EMCDDA 
Landelijk parket 
Eurojust 


University of Hertfordshire - 
Psychopharmacology, Drug Misuse and Novel 
Psychoactive Substances Research Unit, School 
of Life and Medical Sciences 

French Monitoring Centre for Drugs and Drug 
Addiction (OFDT), Unit Emerging trends and new 
drugs (TREND) 


United Kingdom 

The Netherlands 
The Netherlands 
The Netherlands 
The Netherlands 
The Netherlands 
Sweden 

The Netherlands 

Australia 

EU (Portugal) 

The Netherlands 

EU (The 
Netherlands) 

United Kingdom 


France 


161 





RAND Europe 


Internet-facilitated drugs trade 


Name 

Institution 

Country 

Dr Monica Barratt 

NA 

Australia 

Dr Nicolas Christin, Assistant Research 
Professor of Electrical and Computer 
Engineering and Engineering & Public 
Policy 

Carnegie Mellon University 

United States 

Pim Takkenberg 

TNO 

The Netherlands 

Ranieri Argentini 

Nederlands Forensisch Instituut 

The Netherlands 

Sybren Kooistra 

NA 

The Netherlands 

Two Agents 

French Customs Administration 

France 

Two Operational Specialists 

National Crime Squad 

The Netherlands 
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Appendix F: Interview topic guide 



Y 

M 

N 

Question 

Notes/Modifications 

V 

1. Opening 

We'd like to begin by asking some general questions about your professional background and expertise. 

1.1. General questions 





Can you begin by giving us a description of your role in 
this organisation and length in post? 






For how long have you been working in the field of 
online drugs trade [or other relevant topic]? If 
applicable, ask to clarify if experience relates to dark 
and/or clear net drugs trade. 



2. C 
We'd like 

ïaracteristics of Online drugs trade 

o know more about the characteristics of Online drugs trade (clear and dark net ; where possible). 

2.1. Cryptomarkets and other Internet-based marketplaces 





As a starting point, it would be helpful if you could 
provide an overview of the cryptomarkets and other 
(clear net) Internet-based marketplaces that you are 
aware of [e.g. number of markets, whether this is dark 
or clear net, type of drugs sold, etc.) 






What, if any, trends can be observed in the field of 
cryptomarkets and other Internet-based marketplaces 
where drugs are being traded? [E.g. policies on these 
websites, payments, types of drugs, advertisement, etc.) 






In case respondent knows more about the clear net: 

• On what websites are drugs being traded on 
the clear net? 

• Could you explain how drugs are traded on the 
clear net? (e.g. modus operandi; type of 
websites, e.g. online pharmacies; how are 
these websites used (for selling drugs, for 
advertising drugs, as dark net entries, etc.); role 
of social media, etc.) 

• What types of drugs are being traded over the 
clear net? (e.g. illicit drugs versus (sometime 
legal) NPS; use of nicknames, etc.) 

• What are the main countries of origin for the 
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drugs traded on the clear net? 

• In what volumes are the drugs offered? To what 
extent is this Wholesale or retail? ( prompt for 
potential of spreading the risk through buying 
smal/ amounts ) 

• How does the size of trade of different types of 
drugs relate to one another? 

• To what extent are supporting goods and 
services offered on those websites? 

• To what extent are the drugs offered in 
combination with other legal or illegal goods or 
services? If so, which ones? 






What is known about the developers and administrators 
of such marketplaces and websites? (e.g. characteristics, 
modus operandi, individuals versus groups, etc.) 






To what extent do cryptomarkets and other Internet- 
based marketplaces put restrictions on the drugs trade? 






How does the payment of Internet-based drugs trade 
proceed? Are there any differences between dark net 
and clear net? 




2.2. Vendors and other actors (e.g. administrators, couriers, etc.) 





Could you describe the characteristics and modus operandi of the 
vendors involved in the trade of drugs on the Internet (dark versus 
clear net, if possible) and other actors such as administrators and 
couriers? 






What is the role of the Dutch infrastructure and knowledge (e.g. 
Internet hosting) within these markets (clear/dark net) 






(if not answered in previous question) What can be said about the 
characteristics of these vendors in terms of age, gender, country of 
origin, criminal antecedents, etc.? 






What, if any, are the possible trends that occur in terms of the 
number of vendors involved in Online drugs trade (dark/clear net) 
and their listings? 






From what countries do vendors operate primarily? 






To what countries are vendors willing to ship? 






What is the modus operandi in the shipping of these drugs sold on 
the (dark/clear) net? Does this vary per type of drugs? 




2.3. Country of origin 
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What are the main countries of origin for the drugs traded on the 
dark/clear net? 






Based on your experience, are there indications that the Netherlands 
is an important country of origin for drugs trade on the dark/clear 
net? 




2.4. Customers/buyers 





Could you describe the characteristics and modus operandi of the 
customers/buyers involved in the trade of drugs on the Internet [dark 
versus clear net, if possible)? 






(if not answered in previous question) What can be said about the 
characteristics of these customers/buyers in terms of age, gender, 
country of origin, criminal antecedents, etc.? 






What, if any, are the possible trends that occur in terms of the 
characteristics of customers/buyers involved in online drugs trade 
(dark/clear net)? 






What, if any, are the possible trends that occur in terms of the size of 
the population of customers/buyers in the Netherlands involved in 
online drugs trade (dark/clear net)? 






[if not answered in previous question) Could you describe the 
customers/buyers' modus operandi in buying and receiving of drugs 
bought online (dark/clear net)? 




3. Detection and intervention of online drugs trade 

We'd like to know more possible avenues for intervention of online drugs trade (clear and dark net]. 


3.1. Detection and intervention practices 





To begin with, could you describe what detection/intervention 
practices are in place in your country [when interviewee is 
international expert, ask to specify for international/national 
practices s/he is familiar with j? 






Are there are alternative techniques used instead of criminal 
investigation and prosecution, such as techniques that disturb criminal 
processes? [if possible refer to Dutch barder model) 






What parties/organisations are involved in these 

detection/intervention practices? (e.g. Police, Prosecution Service, 
Customs, international organisations, private sector organisations, 
etc.) 






What, if any, possibilities are there to abolish the anonymity during 
the trade and distribution of drugs (not including the production 
processes)? 






What barriers do law enforcers face in the Netherlands (and/or 
abroad, if applicable) in detection and prosecution of online drugs 
trade? [e.g. legal barriers, practical barriers, etc.) 




3.2. Examples of interventions 
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Could you describe one or two examples of interventions in online 
drugs trade you are aware of/was involved in? (e.g. description of 
interventions, name of market place, type of drugs seized, and if 
possible actors involved, etc.) 






Who, if any, were the key partners involved in these interventions? 






Could you describe the consequences of bringing down this/these 
marketplace(s)? To what extent did any substitution effects occur? 






Are you aware of interventions used in other countries? If so, what 
are its key characteristics? (e.g. storting points, partners involved, 
etc.) 




3.3. Successes and challenges 


Overall, based on your experience, what are the key successes and 
challenges in detection and intervention of Online drugs trade? 


Based on your experience, what could be a possible avenue for the 
Dutch government to tackle Online drugs trade? 


4. Additiona 
interview) 


or interview-specific questions (use space to write extra questions before or during 


5. Key Lessons and Closing Questions 

We'd now like to close the interview with a couple of more broadly-oriented questions about your experience in the 
field of online drugs trade 


5.1. Key lessons 


lf you could offer two or three key lessons from your experience with 
dark/clear net research and/or detection/intervention practices, 
what would those lessons be? 


If you could change one thing about dark/clear net research and/or 
detection/intervention practices, what would it be? 
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5.2. Contacts and documents 





Do you have any suggestions for other people that would be relevant 
to interview for this research? Do you have relevant (policy) 
documents that you are able to share with us? 



5.3. Closing Question 





Is there anything you wish to comment on, that you haven't had a 
chance to share during today's interview? 
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